feat: chain condition steps — defeasible/logical evidence as final chain hop

A chain's FINAL (object-side) step may now reference a defeasible/logical
evidence. The compiler lowers it to a condition step
({ rule: <config>, conditionStep: true }) that the engine verifies at
(intermediate, object) instead of traversing an edge. Requires
@arbiter/core@^1.0.3 (ChainRule condition-step support).

- _expandChainSteps: a logical/defeasible/comparator evidence is expressible
  as a final condition step; non-final such steps remain a compile error
  (a condition cannot discover intermediate nodes).
- Dependency collection (generator + DSLRuntime) descends into condition-step
  rule configs, so partial-graph requirements reach through them.

Tests: ChainConditionStep (defeasible + ALWAYS steps, independent checkability,
parallel aggregation), oracle campaign chain_condition_step construct
(oracle = min(pm, pv*(1-pb))), DSLRuntime transitive required facts through a
condition step.

package-lock.json

@@ -1,15 +1,15 @@
 {
   "name": "@arbiter/evidence-dsl",
-  "version": "1.1.0",
+  "version": "1.4.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@arbiter/evidence-dsl",
-      "version": "1.1.0",
+      "version": "1.4.0",
       "license": "ISC",
       "dependencies": {
-        "@arbiter/core": "^1.0.2"
+        "@arbiter/core": "^1.0.3"
       },
       "devDependencies": {
         "@rigor/core": "^3.1.0",
@@ -17,9 +17,9 @@
       }
     },
     "node_modules/@arbiter/core": {
-      "version": "1.0.2",
-      "resolved": "https://hub.kl1.tenere.ai/api/packages/Arbiter/npm/%40arbiter%2Fcore/-/1.0.2/core-1.0.2.tgz",
-      "integrity": "sha512-N1duiHy1Rlsxqpvu8uPf4tMaLOQ2tNXvGs53jLkRcIAYqafIAMvcf0BPS2iE2xVKNsqY92+F05bZZEAO5jnbyQ==",
+      "version": "1.0.3",
+      "resolved": "https://hub.kl1.tenere.ai/api/packages/Arbiter/npm/%40arbiter%2Fcore/-/1.0.3/core-1.0.3.tgz",
+      "integrity": "sha512-MCXxyeWBoYjEJMrdO8N8q9uEdX7JgDvwRH39D+8x65zFz+JCNWIQ8H4DgsP2rgF+yzv/cdVH4BX9PfFt6i0ftQ==",
       "license": "ISC",
       "dependencies": {
         "@tenere/pltc-core": "^0.6.3",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arbiter/evidence-dsl",
-  "version": "1.1.0",
+  "version": "1.4.0",
   "description": "Evidence DSL v2 compiler: translates the natural Evidence DSL (ADR-000) into @arbiter/core relation configurations.",
   "license": "ISC",
   "type": "module",
@@ -24,7 +24,7 @@
     "generate:parser": "node scripts/generate-parser.js"
   },
   "dependencies": {
-    "@arbiter/core": "^1.0.2"
+    "@arbiter/core": "^1.0.3"
   },
   "devDependencies": {
     "@rigor/core": "^3.1.0",

src/generator/RuleGenerator.js

@@ -10,6 +10,7 @@ export class RuleGenerator {
     this.generatedRules = new Map();
     this.errors = [];
     this.dependencyIndex = new Map();
+    this.evidenceNames = new Set();
   }
 
   /**
@@ -38,6 +39,14 @@ export class RuleGenerator {
         this.generateFactConfig(fact);
       });
 
+      // Resolve evidence composition: a rule that references another derived
+      // evidence (WHEN can_read(user, doc) where can_read is an evidence) is
+      // lowered in place to that evidence's own config — compile-time inlining
+      // (a linker pass), so the engine evaluates a fully-resolved config tree
+      // and never needs a sub-query traversal mechanism. Forward references are
+      // handled because every evidence config is built before this pass runs.
+      this.resolveEvidenceReferences();
+
       // Apply generated rules to arbiter
       this.applyRulesToArbiter();
 
@@ -62,6 +71,7 @@ export class RuleGenerator {
    */
   generateEvidenceRules(evidence) {
     const relationName = evidence.name;
+    this.evidenceNames.add(relationName);
     const ruleConfig = this.buildRuleConfig(evidence);
     
     if (ruleConfig) {
@@ -145,6 +155,7 @@ export class RuleGenerator {
         for (const step of rule.steps) {
           if (typeof step === 'string') targetSet.add(step);
           else if (step && typeof step.relation === 'string') targetSet.add(step.relation);
+          else if (step && step.rule) collect(step.rule, targetSet);
         }
       }
       if (rule.type === 'relational_comparator') {
@@ -162,6 +173,7 @@ export class RuleGenerator {
           for (const child of ruleList) collect(child, targetSet);
         }
         if (node?.rule) collect(node.rule, targetSet);
+        if (node?.direct) collect(node.direct, targetSet);
       }
     };
 
@@ -274,7 +286,7 @@ export class RuleGenerator {
   buildSingleStatementRule(statement, evidence) {
     switch (statement.type) {
       case 'DirectEvidence':
-        return this.buildDirectRule(statement);
+        return this.buildDirectRule(statement, evidence);
       case 'PatternMatch':
         return this.buildPatternMatchRule(statement, evidence);
       case 'DefeasibleLogic':
@@ -282,7 +294,7 @@ export class RuleGenerator {
       case 'Fusion':
         return this.buildFusionRule(statement);
       case 'PredicateCall':
-        return this.buildPredicateRule(statement);
+        return this.buildPredicateRule(statement, evidence);
       case 'UnaryExpression':
         return this.buildUnaryRule(statement);
       case 'BinaryExpression':
@@ -291,7 +303,7 @@ export class RuleGenerator {
       case 'Expression':
         // Handle expressions that might be predicate calls
         if (statement.type === 'PredicateCall') {
-          return this.buildPredicateRule(statement);
+          return this.buildPredicateRule(statement, evidence);
         }
         return this.buildRuleFromExpressionNode(statement, evidence);
       default:
@@ -459,7 +471,7 @@ export class RuleGenerator {
    * @param {DirectEvidenceNode} directEvidence - Direct evidence statement
    * @returns {Object|null} Rule configuration or null
    */
-  buildDirectRule(directEvidence) {
+  buildDirectRule(directEvidence, evidence) {
     if (!directEvidence.predicate) {
       this.errors.push('Direct evidence must have a predicate');
       return null;
@@ -468,11 +480,23 @@ export class RuleGenerator {
     const predicate = directEvidence.predicate;
     const relation = predicate.name;
 
-    return {
+    const rule = {
       type: 'direct',
       relation: relation,
       reverse: false
     };
+
+    // Subject-scoped (unary) call: the predicate call's args omit the
+    // evidence's object parameter (user_risk(user, 1) inside a binary
+    // evidence) → check the relation on the subject itself.
+    const evidenceParams = (evidence && evidence.params) || [];
+    const objectVar = evidenceParams[1] && evidenceParams[1].name;
+    const argName = a => a && (a.name !== undefined ? a.name : a.value);
+    if (objectVar !== undefined && !(predicate.arguments || []).some(a => argName(a) === objectVar)) {
+      rule._subjectAsObject = true;
+    }
+
+    return rule;
   }
 
   /**
@@ -925,9 +949,6 @@ export class RuleGenerator {
    * @returns {Object|null} Rule configuration or null
    */
   buildDirectRuleFromPredicate(predicate, evidence) {
-    const expanded = this._expandPredicate(predicate.name);
-    if (expanded) return expanded;
-
     const rule = {
       type: 'direct',
       relation: predicate.name,
@@ -944,36 +965,169 @@ export class RuleGenerator {
     return rule;
   }
 
-  _expandPredicate(predicateName) {
-    const existingConfig = this.generatedRules.get(predicateName) || this.arbiter?.relationConfigs?.get(predicateName);
-    if (!existingConfig) return null;
-    if (!existingConfig.union && !existingConfig.intersection && !existingConfig.exclusion) return null;
+  _expandPredicate() {
+    // Replaced by resolveEvidenceReferences() (the compile-time evidence
+    // composition pass). Predicate references are now emitted as direct rules
+    // and inlined during resolution, which also handles forward references and
+    // preserves the correct _subjectAsObject scoping.
+  }
 
-    const logicalKey = existingConfig.union ? 'union' : existingConfig.intersection ? 'intersection' : 'exclusion';
-    const subRules = Array.isArray(existingConfig[logicalKey]?.rules)
-      ? existingConfig[logicalKey].rules
-      : Array.isArray(existingConfig[logicalKey]) ? existingConfig[logicalKey] : [];
+  /**
+   * Evidence composition pass. Every rule that references a DERIVED evidence
+   * (e.g. `WHEN can_read(user, doc)` where can_read is itself an evidence) is
+   * rewritten to inline that evidence's own config. This runs after all
+   * evidence configs are generated, so forward references resolve; cycles are
+   * detected and reported. The engine therefore evaluates a fully-resolved,
+   * acyclic config tree — no runtime sub-query traversal is needed.
+   */
+  resolveEvidenceReferences() {
+    for (const name of this.evidenceNames) {
+      if (!this.generatedRules.has(name)) continue;
+      const stack = new Set([name]);
+      const resolved = this._resolveRule(this.generatedRules.get(name), stack);
+      this.generatedRules.set(name, resolved);
+      this._annotateDependencies(name, resolved);
+    }
+  }
 
-    if (subRules.length === 0) return null;
+  /**
+   * Recursively rewrite a rule tree, inlining references to derived evidence
+   * configs. `stack` holds the evidence names currently being expanded so a
+   * cyclic reference (A → B → A) is detected and reported.
+   */
+  _resolveRule(rule, stack) {
+    if (!rule || typeof rule !== 'object') return rule;
+    if (Array.isArray(rule)) return rule.map(r => this._resolveRule(r, stack));
 
-    const expandedRules = subRules.map(r => {
-      if (r && r.type === 'direct') return { type: 'direct', relation: r.relation, reverse: !!r.reverse };
-      if (typeof r === 'string') return { type: 'direct', relation: r, reverse: false };
-      return null;
-    }).filter(Boolean);
+    // Direct rule referencing a derived evidence → inline its resolved config.
+    if (rule.type === 'direct' && rule.relation) {
+      const ref = rule.relation;
+      if (this.evidenceNames.has(ref)) {
+        const referencedConfig = this.generatedRules.get(ref);
+        if (referencedConfig) {
+          if (stack.has(ref)) {
+            this.errors.push(`Cyclic evidence reference involving '${ref}'. Evidence composition must be acyclic.`);
+            return rule;
+          }
+          const refStack = new Set(stack);
+          refStack.add(ref);
+          const resolvedRef = this._resolveRule(referencedConfig, refStack);
+          if (resolvedRef) {
+            const clone = this._deepCloneRule(resolvedRef);
+            if (rule._subjectAsObject) clone._subjectAsObject = true;
+            return clone;
+          }
+        }
+      }
+      return rule;
+    }
 
-    if (expandedRules.length === 0) return null;
+    // Recurse into logical / defeasible / nested containers: rule-lists
+    // (union/intersection/exclusion/never/requires/when/unless .rules) and
+    // single nested rules (always.direct, comparator operands).
+    const out = { ...rule };
+    for (const key of ['union', 'intersection', 'exclusion', 'never', 'always', 'requires', 'when', 'unless', 'direct', 'rule']) {
+      const node = out[key];
+      if (!node || typeof node !== 'object') continue;
+      if (Array.isArray(node)) {
+        out[key] = node.map(r => this._resolveRule(r, stack));
+        continue;
+      }
+      const next = { ...node };
+      if (Array.isArray(next.rules)) {
+        next.rules = next.rules.map(r => this._resolveRule(r, stack));
+      }
+      if (next.union && Array.isArray(next.union.rules)) {
+        next.union = { ...next.union, rules: next.union.rules.map(r => this._resolveRule(r, stack)) };
+      }
+      if (next.intersection && Array.isArray(next.intersection.rules)) {
+        next.intersection = { ...next.intersection, rules: next.intersection.rules.map(r => this._resolveRule(r, stack)) };
+      }
+      if (next.direct && typeof next.direct === 'object') {
+        next.direct = this._resolveRule(next.direct, stack);
+      }
+      if (next.rule && typeof next.rule === 'object') {
+        next.rule = this._resolveRule(next.rule, stack);
+      }
+      out[key] = next;
+    }
+    if (out.type === 'relational_comparator') {
+      if (out.left?.rule) out.left = { ...out.left, rule: this._resolveRule(out.left.rule, stack) };
+      if (out.right?.rule) out.right = { ...out.right, rule: this._resolveRule(out.right.rule, stack) };
+    }
+    // Chain steps may reference a derived evidence; expand those steps
+    // (direct evidence → underlying relation, chain evidence → spliced steps).
+    if (rule.type === 'chain' && Array.isArray(out.steps)) {
+      out.steps = this._expandChainSteps(out.steps, stack);
+    }
+    return out;
+  }
 
-    return {
-      type: 'logical',
-      [logicalKey]: {
-        rules: expandedRules,
-        aggregator: existingConfig[logicalKey]?.aggregator || 'min'
-      },
-      // Flag to tell the evaluator: this expanded sub-predicate is unary —
-      // use the subject as the object instead of inheriting the parent's object.
-      _subjectAsObject: true
-    };
+  /**
+   * Expand chain steps that reference a derived evidence:
+   *   - direct evidence  → rename the step to the underlying relation
+   *     (member_of(user,*g){ group_read(g,doc) } where group_read = can_view
+   *      becomes step 'can_view');
+   *   - chain evidence   → splice its steps into this chain (flattening)
+   *     (a step that is itself a sub-path becomes its steps, preserving the
+   *      linear source→…→object traversal);
+   *   - logical / defeasible / comparator evidence → only expressible as a
+   *     FINAL condition-gated step (the object is known, so the engine can
+   *     verify the condition at (intermediate, object) instead of traversing
+   *     an edge). Emitted as a `{ rule: <config> }` step the ChainRule
+   *     evaluates as a condition hop. Non-final such steps are a compile
+   *     error: a condition cannot discover intermediate nodes.
+   */
+  _expandChainSteps(steps, stack) {
+    const out = [];
+    for (let idx = 0; idx < steps.length; idx++) {
+      const step = steps[idx];
+      const isLast = idx === steps.length - 1;
+      const stepName = typeof step === 'string' ? step : step.relation;
+      if (stepName && this.evidenceNames.has(stepName)) {
+        if (stack.has(stepName)) {
+          this.errors.push(`Cyclic evidence reference involving '${stepName}'. Evidence composition must be acyclic.`);
+          out.push(step);
+          continue;
+        }
+        const referencedConfig = this.generatedRules.get(stepName);
+        if (referencedConfig) {
+          const refStack = new Set(stack);
+          refStack.add(stepName);
+          const resolved = this._resolveRule(referencedConfig, refStack);
+          if (resolved.type === 'direct' && resolved.relation && resolved.relation !== stepName) {
+            out.push(typeof step === 'string'
+              ? resolved.relation
+              : { ...step, relation: resolved.relation });
+            continue;
+          }
+          if (resolved.type === 'chain' && Array.isArray(resolved.steps)) {
+            out.push(...this._expandChainSteps(resolved.steps, refStack));
+            continue;
+          }
+          if (isLast) {
+            // Condition-gated final hop: inline the evidence's config as a
+            // rule step the engine evaluates at (intermediate, object).
+            out.push({ rule: this._deepCloneRule(resolved), conditionStep: true });
+            continue;
+          }
+          this.errors.push(`Chain step '${stepName}' references an evidence with type '${resolved.type || 'logical'}'. ` +
+            'Only the final chain step may reference a defeasible/logical evidence (a condition-gated hop); intermediate steps must be edge traversals.');
+          out.push(step);
+          continue;
+        }
+      }
+      out.push(step);
+    }
+    return out;
+  }
+
+  _deepCloneRule(rule) {
+    try {
+      return structuredClone(rule);
+    } catch {
+      return JSON.parse(JSON.stringify(rule));
+    }
   }
 
   /**
@@ -1120,11 +1274,6 @@ export class RuleGenerator {
       return this.buildChallengeRule(expression, null);
     }
 
-    // Expand composite (logical) predicate references into their direct
-    // leaf components so the optimizer can flatten to a correct direct_list.
-    const expanded = this._expandPredicate(predicateName);
-    if (expanded) return expanded;
-
     const rule = {
       type: 'direct',
       relation: predicateName,

src/runtime/DSLRuntime.js

@@ -103,7 +103,11 @@ export class DSLRuntime {
           if (rule.computedRelation) deps.add(rule.computedRelation);
         }
         if (rule.type === 'chain' && Array.isArray(rule.steps)) {
-          for (const s of rule.steps) deps.add(typeof s === 'string' ? s : s.relation);
+          for (const s of rule.steps) {
+            if (typeof s === 'string') deps.add(s);
+            else if (s && s.relation) deps.add(s.relation);
+            else if (s && s.rule) collect(s.rule);
+          }
         }
         if (rule.type === 'parent' && rule.parentRelation) deps.add(rule.parentRelation);
         if (rule.type === 'multi_hop' && rule.relation) deps.add(rule.relation);

src/validation/DSLValidation.js

@@ -41,6 +41,7 @@ export function validateDslText(dslText, options = {}) {
   validateSources(program, tables, errors, warnings, dslText);
   validateMeasures(program, tables, errors, warnings, dslText);
   validateEvidence(program, tables, errors, warnings, dslText);
+  validateCrossKindRelationNames(program, errors, warnings, dslText);
 
   return {
     success: errors.length === 0,
@@ -335,6 +336,37 @@ function validateEvidence(program, tables, errors, warnings, source) {
   }
 }
 
+/**
+ * Relation names must be unique across facts, sources, evidence, and measures.
+ * A fact and an evidence sharing a name would silently overwrite each other's
+ * relation config during generation (and read as a false cyclic reference).
+ */
+function validateCrossKindRelationNames(program, errors, warnings, source) {
+  const seen = new Map();
+  const kinds = [
+    ['fact', program.facts],
+    ['source', program.sources],
+    ['evidence', program.evidence],
+    ['measure', program.measures]
+  ];
+  for (const [kind, items] of kinds) {
+    for (const item of items || []) {
+      const prev = seen.get(item.name);
+      if (prev) {
+        errors.push(createError({
+          message: `Name '${item.name}' is already used by a ${prev} declaration.`,
+          rule: 'Relation names must be unique across facts, sources, evidence, and measures.',
+          fix: `Rename the ${kind} or the ${prev} to a unique name.`,
+          location: findLocation(source, `${kind} ${item.name}`),
+          context: formatContext(source, findLocation(source, item.name))
+        }));
+      } else {
+        seen.set(item.name, kind);
+      }
+    }
+  }
+}
+
 function validateEvidenceBody(body, scope, tables, errors, warnings, source, parent) {
   for (const stmt of body.statements || []) {
     switch (stmt.type) {

tests/ChainConditionStep.test.js

@@ -0,0 +1,101 @@
+/**
+ * tests/ChainConditionStep.test.js — a chain whose FINAL (object-side) hop
+ * references a defeasible/logical evidence. The compiler lowers it to a
+ * condition step: `{ rule: <config>, conditionStep: true }`, which the engine
+ * verifies at (intermediate, object) rather than traversing an edge.
+ *
+ * Only the final step may be a condition (the object is known); an
+ * intermediate condition cannot discover nodes and is a compile error.
+ */
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import { Arbiter } from '@arbiter/core';
+import { DSLCompiler } from '../src/DSLCompiler.js';
+
+const DEFS = `
+  definition Employee { id: string }
+  definition Group { id: string }
+  definition Doc { id: string }
+  fact member_of(user: Employee, group: Group)
+  fact can_view(group: Group, doc: Doc)
+  fact banned(group: Group)
+  fact can_edit(group: Group, doc: Doc)
+`;
+
+function compile(dsl, name = 'chain-cond') {
+  const arb = new Arbiter();
+  const compiler = new DSLCompiler(arb);
+  const result = compiler.compile(dsl, name);
+  return { arb, result };
+}
+
+describe('Chain condition step (logical evidence as final hop)', () => {
+  it('lowers a defeasible final step to a condition step and grants', () => {
+    const { arb, result } = compile(`
+      ${DEFS}
+      evidence gated(group: Group, doc: Doc) { WHEN can_view(group, doc) UNLESS banned(group) }
+      evidence can_via(user: Employee, doc: Doc) { member_of(user, *g) { gated(g, doc) } }
+    `);
+    assert.ok(result.success, JSON.stringify(result.errors));
+    const steps = arb.relationConfigs.get('can_via').steps;
+    assert.equal(steps[0], 'member_of');
+    assert.equal(steps[1].conditionStep, true);
+    assert.equal(steps[1].rule.type, 'logical');
+    // transitive dependency collection through the condition step
+    assert.deepEqual(arb.relationConfigs.get('can_via').dependsOn, ['member_of', 'can_view', 'banned']);
+
+    arb.addNode('u:1', 'Employee'); arb.addNode('g:1', 'Group'); arb.addNode('doc:9', 'Doc');
+    arb.addRelation('u:1', 'member_of', 'g:1', { possibility: 1.0 });
+    arb.addRelation('g:1', 'can_view', 'doc:9', { possibility: 0.7 });
+    assert.equal(arb.check('u:1', 'can_via', 'doc:9').possibility, 0.7);
+
+    // banning the intermediate defeats the condition hop
+    arb.addRelation('g:1', 'banned', 'g:1', { possibility: 1.0 });
+    assert.equal(arb.check('u:1', 'can_via', 'doc:9').possibility, 0);
+  });
+
+  it('supports ALWAYS/NEVER evidence as a condition step', () => {
+    const { arb, result } = compile(`
+      ${DEFS}
+      evidence gated(group: Group, doc: Doc) { ALWAYS can_edit(group, doc) }
+      evidence can_via(user: Employee, doc: Doc) { member_of(user, *g) { gated(g, doc) } }
+    `);
+    assert.ok(result.success, JSON.stringify(result.errors));
+    const steps = arb.relationConfigs.get('can_via').steps;
+    assert.equal(steps[1].conditionStep, true);
+    arb.addNode('u:1', 'Employee'); arb.addNode('g:1', 'Group'); arb.addNode('doc:9', 'Doc');
+    arb.addRelation('u:1', 'member_of', 'g:1', { possibility: 1.0 });
+    arb.addRelation('g:1', 'can_edit', 'doc:9', { possibility: 0.6 });
+    assert.equal(arb.check('u:1', 'can_via', 'doc:9').possibility, 0.6);
+    arb.removeRelation('g:1', 'can_edit', 'doc:9');
+    assert.equal(arb.check('u:1', 'can_via', 'doc:9').possibility, 0);
+  });
+
+  it('keeps the condition evidence checkable in its own right', () => {
+    const { arb, result } = compile(`
+      ${DEFS}
+      evidence gated(group: Group, doc: Doc) { WHEN can_view(group, doc) UNLESS banned(group) }
+      evidence can_via(user: Employee, doc: Doc) { member_of(user, *g) { gated(g, doc) } }
+    `);
+    assert.ok(result.success, JSON.stringify(result.errors));
+    arb.addNode('g:1', 'Group'); arb.addNode('doc:9', 'Doc');
+    arb.addRelation('g:1', 'can_view', 'doc:9', { possibility: 0.8 });
+    assert.equal(arb.check('g:1', 'gated', 'doc:9').possibility, 0.8);
+  });
+
+  it('parallel intermediates aggregate through the condition step', () => {
+    const { arb, result } = compile(`
+      ${DEFS}
+      evidence gated(group: Group, doc: Doc) { can_view(group, doc) }
+      evidence can_via(user: Employee, doc: Doc) { member_of(user, *g) { gated(g, doc) } }
+    `);
+    assert.ok(result.success, JSON.stringify(result.errors));
+    arb.addNode('u:1', 'Employee'); arb.addNode('g:1', 'Group'); arb.addNode('g2:2', 'Group'); arb.addNode('doc:9', 'Doc');
+    arb.addRelation('u:1', 'member_of', 'g:1', { possibility: 0.5 });
+    arb.addRelation('g:1', 'can_view', 'doc:9', { possibility: 0.7 });
+    arb.addRelation('u:1', 'member_of', 'g2:2', { possibility: 1.0 });
+    arb.addRelation('g2:2', 'can_view', 'doc:9', { possibility: 0.8 });
+    // max over paths: min(0.5,0.7)=0.5, min(1.0,0.8)=0.8 -> 0.8
+    assert.equal(arb.check('u:1', 'can_via', 'doc:9').possibility, 0.8);
+  });
+});

tests/ChainStepComposition.test.js

@@ -0,0 +1,127 @@
+/**
+ * tests/ChainStepComposition.test.js — evidence composition inside CHAIN
+ * steps. A chain step that references a derived evidence is expanded at
+ * compile time:
+ *   - a DIRECT evidence step → renamed to its underlying relation
+ *     (member_of(user,*g){ group_read(g,doc) } where group_read = can_view
+ *      becomes step 'can_view');
+ *   - a CHAIN evidence step → its steps are spliced into the parent chain
+ *     (a sub-path flattens into the linear source→…→object traversal);
+ *   - a DEFEASIBLE / LOGICAL / COMPARATOR evidence step is not an edge
+ *     traversal and is rejected at compile time;
+ *   - cycles and self-references through chain steps are compile errors.
+ */
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import { Arbiter } from '@arbiter/core';
+import { DSLCompiler } from '../src/DSLCompiler.js';
+
+const DEFS = `
+  definition Employee { id: string }
+  definition Group { id: string }
+  definition Doc { id: string }
+  fact member_of(user: Employee, group: Group)
+  fact group_has(group: Group, sub: Group)
+  fact can_view(group: Group, doc: Doc)
+  fact can_access(group: Group, doc: Doc)
+  fact banned(group: Group)
+`;
+
+function compile(dsl, name = 'chain-compose') {
+  const arb = new Arbiter();
+  const compiler = new DSLCompiler(arb);
+  const result = compiler.compile(dsl, name);
+  return { arb, result };
+}
+
+describe('Chain step composition', () => {
+  it('renames a direct-evidence chain step to its underlying relation', () => {
+    const { arb, result } = compile(`
+      ${DEFS}
+      evidence group_read(group: Group, doc: Doc) { can_view(group, doc) }
+      evidence can_via(user: Employee, doc: Doc) { member_of(user, *g) { group_read(g, doc) } }
+    `);
+    assert.ok(result.success, JSON.stringify(result.errors));
+    // step 'group_read' → 'can_view'
+    assert.deepEqual(arb.relationConfigs.get('can_via').steps, ['member_of', 'can_view']);
+    arb.addNode('u:1', 'Employee'); arb.addNode('g:1', 'Group'); arb.addNode('doc:9', 'Doc');
+    arb.addRelation('u:1', 'member_of', 'g:1', { possibility: 1.0 });
+    arb.addRelation('g:1', 'can_view', 'doc:9', { possibility: 0.7 });
+    assert.equal(arb.check('u:1', 'can_via', 'doc:9').possibility, 0.7);
+  });
+
+  it('splices a chain-evidence step into the parent chain', () => {
+    const { arb, result } = compile(`
+      ${DEFS}
+      evidence group_enter(group: Group, doc: Doc) { group_has(group, *s) { can_access(s, doc) } }
+      evidence can_deep(user: Employee, doc: Doc) { member_of(user, *g) { group_enter(g, doc) } }
+    `);
+    assert.ok(result.success, JSON.stringify(result.errors));
+    // step 'group_enter' → its steps [group_has, can_access]
+    assert.deepEqual(arb.relationConfigs.get('can_deep').steps, ['member_of', 'group_has', 'can_access']);
+    arb.addNode('u:1', 'Employee'); arb.addNode('g:1', 'Group'); arb.addNode('g2:2', 'Group'); arb.addNode('doc:9', 'Doc');
+    arb.addRelation('u:1', 'member_of', 'g:1', { possibility: 1.0 });
+    arb.addRelation('g:1', 'group_has', 'g2:2', { possibility: 0.9 });
+    arb.addRelation('g2:2', 'can_access', 'doc:9', { possibility: 0.8 });
+    assert.equal(arb.check('u:1', 'can_deep', 'doc:9').possibility, 0.8);
+  });
+
+  it('expands a chain step whose direct evidence is itself composed', () => {
+    const { arb, result } = compile(`
+      ${DEFS}
+      evidence group_view(group: Group, doc: Doc) { can_view(group, doc) }
+      evidence group_read(group: Group, doc: Doc) { group_view(group, doc) }
+      evidence can_via(user: Employee, doc: Doc) { member_of(user, *g) { group_read(g, doc) } }
+    `);
+    assert.ok(result.success, JSON.stringify(result.errors));
+    assert.deepEqual(arb.relationConfigs.get('can_via').steps, ['member_of', 'can_view']);
+    arb.addNode('u:1', 'Employee'); arb.addNode('g:1', 'Group'); arb.addNode('doc:9', 'Doc');
+    arb.addRelation('u:1', 'member_of', 'g:1', { possibility: 1.0 });
+    arb.addRelation('g:1', 'can_view', 'doc:9', { possibility: 0.6 });
+    assert.equal(arb.check('u:1', 'can_via', 'doc:9').possibility, 0.6);
+  });
+
+  it('lowers a logical evidence FINAL step to a condition step', () => {
+    const { arb, result } = compile(`
+      ${DEFS}
+      evidence gated(group: Group, doc: Doc) { WHEN can_view(group, doc) UNLESS banned(group) }
+      evidence can_via(user: Employee, doc: Doc) { member_of(user, *g) { gated(g, doc) } }
+    `);
+    assert.ok(result.success, JSON.stringify(result.errors));
+    // final-step logical evidence → condition step (verified at the object)
+    const steps = arb.relationConfigs.get('can_via').steps;
+    assert.equal(steps[0], 'member_of');
+    assert.equal(steps[1].conditionStep, true);
+    assert.equal(steps[1].rule.type, 'logical');
+  });
+
+  it('rejects a mutual cycle through chain steps', () => {
+    const { result } = compile(`
+      ${DEFS}
+      evidence cyc_a(group: Group, doc: Doc) { group_has(group, *g) { cyc_b(g, doc) } }
+      evidence cyc_b(group: Group, doc: Doc) { cyc_a(group, doc) }
+    `);
+    assert.equal(result.success, false);
+    assert.ok(result.errors.some(e => /[Cc]yclic/.test(e)), JSON.stringify(result.errors));
+  });
+
+  it('rejects a self-reference through its own chain step', () => {
+    const { result } = compile(`
+      ${DEFS}
+      evidence cyc_c(group: Group, doc: Doc) { group_has(group, *g) { cyc_c(g, doc) } }
+    `);
+    assert.equal(result.success, false);
+    assert.ok(result.errors.some(e => /[Cc]yclic/.test(e)), JSON.stringify(result.errors));
+  });
+
+  it('re-derives transitive dependencies through expanded chain steps', () => {
+    const { arb, result } = compile(`
+      ${DEFS}
+      evidence group_read(group: Group, doc: Doc) { can_view(group, doc) }
+      evidence can_via(user: Employee, doc: Doc) { member_of(user, *g) { group_read(g, doc) } }
+    `);
+    assert.ok(result.success, JSON.stringify(result.errors));
+    // dependsOn reflects the expanded step, not the evidence reference
+    assert.deepEqual(arb.relationConfigs.get('can_via').dependsOn, ['member_of', 'can_view']);
+  });
+});

tests/DSLRuntime.test.js

@@ -161,4 +161,48 @@ describe('DSLRuntime', () => {
     rt.addNode('doc:9', 'Doc', {});
     await assert.rejects(() => rt.check('u:1', 'does_not_exist', 'doc:9'), /unknown relation/);
   });
+
+  it('derives transitive required facts through evidence composition', async () => {
+    const dsl = `
+      definition Employee { id: string }
+      definition Doc { id: string }
+      fact *owns(user: Employee, doc: Doc)
+      fact *banned(user: Employee)
+      evidence can_read(user: Employee, doc: Doc) { owns(user, doc) }
+      evidence can_open(user: Employee, doc: Doc) { WHEN can_read(user, doc) UNLESS banned(user) }
+    `;
+    const rt = new DSLRuntime(new Arbiter()).compile(dsl, 'rt-comp');
+    rt.addNode('u:1', 'Employee', {});
+    rt.addNode('doc:9', 'Doc', {});
+    // can_open composes can_read, so its requirements reach through to owns.
+    assert.deepEqual(rt.requiredFacts('can_open'), ['owns', 'banned']);
+    const granted = await rt.check('u:1', 'can_open', 'doc:9', {
+      factProviders: { owns: async () => 0.9, banned: async () => 0 }
+    });
+    assert.equal(granted.possibility, 0.9);
+    assert.equal(granted.reason, 'allow_rule_matched');
+    assert.deepEqual(granted.providedFacts, ['owns', 'banned']);
+    const denied = await rt.check('u:1', 'can_open', 'doc:9', {
+      factProviders: { owns: async () => 0.9, banned: async () => 1 }
+    });
+    assert.equal(denied.possibility, 0);
+    assert.equal(denied.reason, 'defeated_by_unless');
+  });
+
+  it('derives transitive required facts through a condition-step chain', () => {
+    const dsl = `
+      definition Employee { id: string }
+      definition Group { id: string }
+      definition Doc { id: string }
+      fact *member_of(user: Employee, group: Group)
+      fact *can_view(group: Group, doc: Doc)
+      fact *banned(group: Group)
+      evidence gated(group: Group, doc: Doc) { WHEN can_view(group, doc) UNLESS banned(group) }
+      evidence can_via(user: Employee, doc: Doc) { member_of(user, *g) { gated(g, doc) } }
+    `;
+    const rt = new DSLRuntime(new Arbiter()).compile(dsl, 'rt-cond');
+    // The condition step's facts (can_view, banned) reach through to the
+    // evidence's requirements, alongside the edge-traversal fact.
+    assert.deepEqual(rt.requiredFacts('can_via'), ['member_of', 'can_view', 'banned']);
+  });
 });

tests/EvidenceComposition.test.js

@@ -0,0 +1,154 @@
+/**
+ * tests/EvidenceComposition.test.js — referencing a derived evidence as a
+ * sub-rule of another evidence (WHEN can_read(user, doc) where can_read is
+ * itself an evidence).
+ *
+ * Composition is resolved at COMPILE time: the generator inlines each
+ * evidence reference with the referenced evidence's own config (a linker
+ * pass that handles forward references and rejects cycles), so the engine
+ * evaluates a fully-resolved, acyclic config tree.
+ */
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import { Arbiter } from '@arbiter/core';
+import { DSLCompiler } from '../src/DSLCompiler.js';
+
+const DEFS = `
+  definition Employee { id: string }
+  definition Group { id: string }
+  definition Doc { id: string }
+  fact owns(user: Employee, doc: Doc)
+  fact *trusted(user: Employee)
+  fact member_of(user: Employee, group: Group)
+  fact can_access(group: Group, doc: Doc)
+`;
+
+function compile(dsl, name = 'compose') {
+  const arb = new Arbiter();
+  const compiler = new DSLCompiler(arb);
+  const result = compiler.compile(dsl, name);
+  return { arb, result };
+}
+
+describe('Evidence composition', () => {
+  it('composes a direct evidence into another evidence', () => {
+    const { arb, result } = compile(`
+      ${DEFS}
+      evidence can_read(user: Employee, doc: Doc) { owns(user, doc) }
+      evidence can_browse(user: Employee, doc: Doc) { can_read(user, doc) }
+    `);
+    assert.ok(result.success, JSON.stringify(result.errors));
+    arb.addNode('u:1', 'Employee'); arb.addNode('doc:9', 'Doc');
+    arb.addRelation('u:1', 'owns', 'doc:9', { possibility: 0.8 });
+    const res = arb.check('u:1', 'can_browse', 'doc:9');
+    assert.equal(res.possibility, 0.8);
+    // The reference is inlined to the underlying fact config.
+    assert.equal(arb.relationConfigs.get('can_browse').type, 'direct');
+    assert.equal(arb.relationConfigs.get('can_browse').relation, 'owns');
+  });
+
+  it('composes an evidence inside a defeasible WHEN/UNLESS', () => {
+    const { arb, result } = compile(`
+      ${DEFS}
+      evidence can_read(user: Employee, doc: Doc) { owns(user, doc) }
+      evidence can_open(user: Employee, doc: Doc) { WHEN can_read(user, doc) UNLESS trusted(user) }
+    `);
+    assert.ok(result.success, JSON.stringify(result.errors));
+    arb.addNode('u:1', 'Employee'); arb.addNode('doc:9', 'Doc');
+    arb.addRelation('u:1', 'owns', 'doc:9', { possibility: 0.9 });
+    assert.equal(arb.check('u:1', 'can_open', 'doc:9').possibility, 0.9);
+    arb.addRelation('u:1', 'trusted', 'u:1', { possibility: 1.0 });
+    const denied = arb.check('u:1', 'can_open', 'doc:9');
+    assert.equal(denied.possibility, 0);
+    assert.equal(denied.reason, 'defeated_by_unless');
+  });
+
+  it('composes a chain evidence into another evidence', () => {
+    const { arb, result } = compile(`
+      ${DEFS}
+      evidence can_enter(user: Employee, doc: Doc) { member_of(user, *g) { can_access(g, doc) } }
+      evidence can_work(user: Employee, doc: Doc) { can_enter(user, doc) }
+    `);
+    assert.ok(result.success, JSON.stringify(result.errors));
+    arb.addNode('u:1', 'Employee'); arb.addNode('g:1', 'Group'); arb.addNode('doc:9', 'Doc');
+    arb.addRelation('u:1', 'member_of', 'g:1', { possibility: 1.0 });
+    arb.addRelation('g:1', 'can_access', 'doc:9', { possibility: 0.7 });
+    const res = arb.check('u:1', 'can_work', 'doc:9');
+    assert.equal(res.possibility, 0.7);
+    assert.equal(arb.relationConfigs.get('can_work').type, 'chain');
+  });
+
+  it('composes transitively (A → B → fact) and re-derives dependencies', () => {
+    const { arb, result } = compile(`
+      ${DEFS}
+      evidence can_read(user: Employee, doc: Doc) { owns(user, doc) }
+      evidence can_browse(user: Employee, doc: Doc) { can_read(user, doc) }
+      evidence can_open(user: Employee, doc: Doc) { can_browse(user, doc) }
+    `);
+    assert.ok(result.success, JSON.stringify(result.errors));
+    arb.addNode('u:1', 'Employee'); arb.addNode('doc:9', 'Doc');
+    arb.addRelation('u:1', 'owns', 'doc:9', { possibility: 0.6 });
+    assert.equal(arb.check('u:1', 'can_open', 'doc:9').possibility, 0.6);
+    assert.deepEqual(arb.relationConfigs.get('can_open').dependsOn, ['owns']);
+  });
+
+  it('composes a value-carrying evidence and preserves subject-as-object scope', () => {
+    const { arb, result } = compile(`
+      ${DEFS}
+      fact *user_risk(user: Employee, value: number)
+      evidence risk_ok(user: Employee, doc: Doc) { user_risk(user, 1) }
+      evidence can_proceed(user: Employee, doc: Doc) { risk_ok(user, doc) }
+    `);
+    assert.ok(result.success, JSON.stringify(result.errors));
+    arb.addNode('u:1', 'Employee'); arb.addNode('doc:9', 'Doc');
+    arb.addRelation('u:1', 'user_risk', 'u:1', { possibility: 1.0, value: 1 });
+    const res = arb.check('u:1', 'can_proceed', 'doc:9');
+    assert.equal(res.possibility, 1);
+  });
+
+  it('composes evidence inside a comparator operand', () => {
+    const { arb, result } = compile(`
+      ${DEFS}
+      fact *user_risk(user: Employee, value: number)
+      fact *risk_limit(doc: Doc, value: number)
+      evidence user_risk_ok(user: Employee, doc: Doc) { user_risk(user, 1) }
+      evidence can_proceed(user: Employee, doc: Doc) { user_risk_ok(user, doc) }
+    `);
+    assert.ok(result.success, JSON.stringify(result.errors));
+    arb.addNode('u:1', 'Employee'); arb.addNode('doc:9', 'Doc');
+    arb.addRelation('u:1', 'user_risk', 'u:1', { possibility: 1.0, value: 1 });
+    assert.equal(arb.check('u:1', 'can_proceed', 'doc:9').possibility, 1);
+  });
+
+  it('rejects cyclic evidence references at compile time', () => {
+    const { result } = compile(`
+      ${DEFS}
+      evidence a(user: Employee, doc: Doc) { b(user, doc) }
+      evidence b(user: Employee, doc: Doc) { a(user, doc) }
+    `);
+    assert.equal(result.success, false);
+    assert.ok(result.errors.some(e => /[Cc]yclic/.test(e)), JSON.stringify(result.errors));
+  });
+
+  it('rejects self-referencing evidence at compile time', () => {
+    const { result } = compile(`
+      ${DEFS}
+      evidence a(user: Employee, doc: Doc) { a(user, doc) }
+    `);
+    assert.equal(result.success, false);
+    assert.ok(result.errors.some(e => /[Cc]yclic/.test(e)), JSON.stringify(result.errors));
+  });
+
+  it('keeps the referenced evidence checkable in its own right', () => {
+    const { arb, result } = compile(`
+      ${DEFS}
+      evidence can_read(user: Employee, doc: Doc) { owns(user, doc) }
+      evidence can_browse(user: Employee, doc: Doc) { can_read(user, doc) }
+    `);
+    assert.ok(result.success);
+    arb.addNode('u:1', 'Employee'); arb.addNode('doc:9', 'Doc');
+    arb.addRelation('u:1', 'owns', 'doc:9', { possibility: 0.5 });
+    assert.equal(arb.check('u:1', 'can_read', 'doc:9').possibility, 0.5);
+    assert.equal(arb.check('u:1', 'can_browse', 'doc:9').possibility, 0.5);
+  });
+});

tests/EvidenceTests.js

@@ -45,6 +45,7 @@ const DSL_SUPPORT = `
   fact isMember(user: any, group: any)
   fact isFriend(user: any, friend: any)
   fact similar(a: any, b: any)
+  fact reachable(user: any, doc: any)
   fact parentOf(user: any, parent: any)
   fact isEditable(doc: any)
   fact isPublic(doc: any)
@@ -159,7 +160,7 @@ describe('Evidence Rules', () => {
       {
         input: `evidence canRead(user: Employee, doc: Document) {
           isMember(user, *group) {
-            canRead(group, doc)
+            reachable(group, doc)
           }
         }`,
         description: 'Basic pattern matching with wildcard'
@@ -167,7 +168,7 @@ describe('Evidence Rules', () => {
       {
         input: `evidence canRead(user: Employee, doc: Document) {
           isMember(user, *group) {
-            canRead(group, doc)
+            reachable(group, doc)
           } limit 5
         }`,
         description: 'Pattern matching with limit'
@@ -175,7 +176,7 @@ describe('Evidence Rules', () => {
       {
         input: `evidence canRead(user: Employee, doc: Document) {
           similar(doc, *similar) |similarity| {
-            canRead(user, similar)
+            reachable(user, similar)
           } with similarity > 0.7
         }`,
         description: 'Pattern matching with binding and condition'
@@ -183,7 +184,7 @@ describe('Evidence Rules', () => {
       {
         input: `evidence canRead(user: Employee, doc: Document) {
           similar(doc, *similar) |similarity| {
-            canRead(user, similar)
+            reachable(user, similar)
           } limit 5 with similarity > 0.7
         }`,
         description: 'Pattern matching with binding, condition, and limit'
@@ -192,7 +193,7 @@ describe('Evidence Rules', () => {
         input: `evidence canRead(user: Employee, doc: Document) {
           isMember(user, *group) {
             isMember(group, *parentGroup) {
-              canRead(parentGroup, doc)
+              reachable(parentGroup, doc)
             } limit 2
           } limit 3
         }`,
@@ -202,7 +203,7 @@ describe('Evidence Rules', () => {
         input: `evidence canRead(user: Employee, doc: Document) {
           isFriend(user, *friend) {
             isMember(friend, *group) {
-              canRead(group, doc)
+              reachable(group, doc)
             } limit 1
           } limit 5
         }`,
@@ -291,15 +292,15 @@ describe('Evidence Rules', () => {
           owns(user, doc)
 
           isMember(user, *group) {
-            canRead(group, doc)
+            reachable(group, doc)
           } limit 5
 
           parentOf(user, *parent) {
-            canRead(parent, doc)
+            reachable(parent, doc)
           } limit 3
 
           similar(doc, *similar) |similarity| {
-            canRead(user, similar)
+            reachable(user, similar)
           } limit 5 with similarity > 0.7
 
           WHEN hasRole(user, 'admin') UNLESS isSuspended(user)
@@ -337,11 +338,11 @@ describe('Evidence Rules', () => {
           owns(user, doc)
 
           isMember(user, *group) {
-            canModify(group, doc)
+            reachable(group, doc)
           } limit 3
 
           similar(doc, *similar) |similarity| {
-            canModify(user, similar)
+            reachable(user, similar)
             isEditable(similar)
           } limit 2 with similarity > 0.8
 
@@ -385,7 +386,7 @@ describe('Evidence Rules', () => {
       {
         input: `evidence canRead(user: Employee, doc: Document) {
           isMember(user, *group) {
-            canRead(group, doc)
+            reachable(group, doc)
           } with
         }`,
         description: 'Incomplete with clause should fail'
@@ -393,7 +394,7 @@ describe('Evidence Rules', () => {
       {
         input: `evidence canRead(user: Employee, doc: Document) {
           isMember(user, *group) {
-            canRead(group, doc)
+            reachable(group, doc)
           } limit
         }`,
         description: 'Incomplete limit should fail'

tests/IntegrationTests.js

@@ -105,6 +105,7 @@ describe('Integration Tests', () => {
       fact hasAccess(user: Employee, resource: Resource, level: string) CACHE lazy
       fact isColleague(user: any, colleague: any) symmetrical CACHE lazy limit 50
       fact isParentOf(parent: Employee, child: Employee) transitive CACHE eager limit 3
+      fact reachable(user: any, doc: any) CACHE lazy
       fact hasClearance(user: Employee, level: string) CACHE eager
       fact parentOf(user: any, parent: any) CACHE eager
       fact similar(a: any, b: any) CACHE lazy
@@ -119,15 +120,15 @@ describe('Integration Tests', () => {
         owns(user, doc)
 
         isMember(user, *group) {
-          canRead(group, doc)
+          reachable(group, doc)
         } limit 5
 
         parentOf(user, *parent) {
-          canRead(parent, doc)
+          reachable(parent, doc)
         } limit 3
 
         similar(doc, *similar) |similarity| {
-          canRead(user, similar)
+          reachable(user, similar)
         } limit 5 with similarity > 0.7
 
         WHEN hasRole(user, 'admin') UNLESS isSuspended(user)
@@ -137,7 +138,7 @@ describe('Integration Tests', () => {
         owns(user, doc)
 
         isMember(user, *group) {
-          canWrite(group, doc)
+          reachable(group, doc)
         } limit 3
 
         WHEN hasRole(user, 'admin') UNLESS isSuspended(user)
@@ -330,6 +331,7 @@ describe('Integration Tests', () => {
 
       fact isMember(user: any, org: any) transitive CACHE lazy limit 5
       fact isParentOf(parent: Organization, child: Organization) transitive CACHE eager limit 3
+      fact reachable(user: any, doc: any) CACHE lazy
       fact hasRole(user: Employee, role: string) CACHE eager
       fact hasClearance(user: Employee, level: string) CACHE eager
       fact isSuspended(user: any) CACHE lazy
@@ -339,7 +341,7 @@ describe('Integration Tests', () => {
         isMember(user, org)
 
         isParentOf(org, *parentOrg) {
-          canAccessOrg(user, parentOrg)
+          reachable(user, parentOrg)
         } limit 3
 
         WHEN hasRole(user, 'admin') UNLESS isSuspended(user)
@@ -347,11 +349,11 @@ describe('Integration Tests', () => {
 
       evidence canAccessResource(user: Employee, resource: Resource) {
         isMember(user, *org) {
-          canAccessResource(org, resource)
+          reachable(org, resource)
         } limit 5
 
         parentOf(user, *parent) {
-          canAccessResource(parent, resource)
+          reachable(parent, resource)
         } limit 2
       }
     `;
@@ -379,6 +381,7 @@ describe('Integration Tests', () => {
       fact hasInterest(user: any, interest: string) CACHE lazy
       fact hasTag(doc: any, tag: string) CACHE lazy
       fact owns(user: any, doc: any) CACHE eager
+      fact reachable(user: any, doc: any) CACHE lazy
       fact similar(a: any, b: any) CACHE lazy
       fact isPublic(doc: any) CACHE eager
       fact hasInterests(user: any) CACHE lazy
@@ -390,12 +393,12 @@ describe('Integration Tests', () => {
         owns(user, doc)
 
         similar(doc, *similar) |similarity| {
-          canRead(user, similar)
+          reachable(user, similar)
           isPublic(similar)
         } limit 10 with similarity > 0.7
 
         isFriend(user, *friend) {
-          canRead(friend, doc)
+          reachable(friend, doc)
         } limit 5
 
         fusion majority {
@@ -406,7 +409,7 @@ describe('Integration Tests', () => {
 
       evidence canRecommend(user: Employee, doc: Document) {
         similar(user, *similarUser) |similarity| {
-          canRead(similarUser, doc)
+          reachable(similarUser, doc)
         } limit 20 with similarity > 0.8
 
         fusion average {
@@ -556,13 +559,14 @@ describe('Integration Tests', () => {
       fact isFriend(user: any, friend: any) symmetrical CACHE eager limit 50
       fact hasPermission(user: Employee, resource: Resource, action: string) CACHE eager
       fact owns(user: Employee, resource: Resource) CACHE eager
+  fact reachable(user: any, doc: any) CACHE lazy
 
       // Optimized evidence rules
       evidence canAccess(user: Employee, resource: Resource) {
         owns(user, resource)
 
         isMember(user, *group) {
-          canAccess(group, resource)
+          reachable(group, resource)
         } limit 3
 
         WHEN hasPermission(user, resource, 'read')
@@ -572,7 +576,7 @@ describe('Integration Tests', () => {
         owns(user, resource)
 
         isMember(user, *group) {
-          canModify(group, resource)
+          reachable(group, resource)
         } limit 2
 
         WHEN hasPermission(user, resource, 'write')

tests/rigor/dsl-generative-oracle.test.js

@@ -32,7 +32,9 @@ const FACTS = `
   fact can_access(group: Group, doc: Doc)
   fact owner(group: Group, doc: Doc)
   fact granted(user: Employee, doc: Doc)
+  fact group_perm(group: Group, doc: Doc)
   fact banned(user: Employee)
+  fact group_banned(group: Group)
   fact mfa(user: Employee)
 `;
 
@@ -106,11 +108,52 @@ function buildProgram(kind, ps) {
       oracle = pG * pM;
       break;
     }
+    case 'composition': {
+      // can_via composes the direct evidence can_read, which reads the owns
+      // edge — an evidence-in-evidence reference resolved at compile time.
+      const [pOwn] = ps;
+      evidence = `evidence can_read(user: Employee, doc: Doc) { owns(user, doc) }
+                  evidence can_via(user: Employee, doc: Doc) { can_read(user, doc) }`;
+      edges.push({ src: 'u:1', relation: 'owns', dst: 'doc:9', possibility: pOwn });
+      oracle = pOwn;
+      break;
+    }
+    case 'chain_step_composition': {
+      // group_read (a direct evidence) used as a CHAIN STEP inside can_via:
+      // the step is expanded at compile time to the underlying can_view edge.
+      const [pm, pv] = ps;
+      evidence = `evidence group_read(group: Group, doc: Doc) { group_perm(group, doc) }
+                  evidence can_via(user: Employee, doc: Doc) { member_of(user, *g) { group_read(g, doc) } }`;
+      edges.push({ src: 'u:1', relation: 'member_of', dst: 'g:1', possibility: pm });
+      edges.push({ src: 'g:1', relation: 'group_perm', dst: 'doc:9', possibility: pv });
+      oracle = Math.min(pm, pv);
+      break;
+    }
+    case 'chain_condition_step': {
+      // gated (a defeasible evidence) as the FINAL chain step → a condition
+      // step: the engine verifies gated at (intermediate, object). The oracle
+      // is the chain's min combined with the condition's base*(1-defeat).
+      const [pm, pv, pb] = ps;
+      evidence = `evidence gated(group: Group, doc: Doc) { WHEN group_perm(group, doc) UNLESS group_banned(group) }
+                  evidence can_via(user: Employee, doc: Doc) { member_of(user, *g) { gated(g, doc) } }`;
+      edges.push({ src: 'u:1', relation: 'member_of', dst: 'g:1', possibility: pm });
+      edges.push({ src: 'g:1', relation: 'group_perm', dst: 'doc:9', possibility: pv });
+      edges.push({ src: 'g:1', relation: 'group_banned', dst: 'g:1', possibility: pb });
+      oracle = Math.min(pm, pv * (1 - pb));
+      break;
+    }
     default:
       throw new Error(`unknown construct: ${kind}`);
   }
 
-  return { dsl: FACTS + evidence, edges, oracle, relation: evidence.match(/evidence (\w+)/)[1] };
+  return {
+    dsl: FACTS + evidence,
+    edges,
+    oracle,
+    // Check the LAST evidence declaration: the composition construct declares
+    // two evidences (can_read + can_via), and the composed one is the target.
+    relation: [...evidence.matchAll(/evidence\s+(\w+)/g)].at(-1)[1]
+  };
 }
 
 function runCheck({ kind, ps }) {
@@ -134,7 +177,8 @@ function runCheck({ kind, ps }) {
 }
 
 const CONSTRUCTS = ['direct', 'chain', 'tuple_to_userset', 'fusion_min', 'fusion_max',
-  'when_unless', 'never_always', 'requires_when'];
+  'when_unless', 'never_always', 'requires_when', 'composition', 'chain_step_composition',
+  'chain_condition_step'];
 
 describe('DSL generative oracle parity (rigor)', () => {
   it('generated legal DSL compiles and every check matches the oracle', async () => {
@@ -145,7 +189,7 @@ describe('DSL generative oracle parity (rigor)', () => {
             kind: rigor.gen.oneOf(CONSTRUCTS),
             // exactly two edge possibilities (direct uses only the first);
             // a shorter array would leave pB undefined and produce a NaN oracle
-            ps: rigor.gen.tuple(rigor.gen.oneOf(P), rigor.gen.oneOf(P))
+            ps: rigor.gen.tuple(rigor.gen.oneOf(P), rigor.gen.oneOf(P), rigor.gen.oneOf(P))
           })
         ))
       ],
@@ -163,13 +207,14 @@ describe('DSL generative oracle parity (rigor)', () => {
   });
 
   it('exhaustive deterministic sweep: every construct x every possibility value', () => {
-    // Anti-vacuity complement to the campaign: sweep the full P × P grid per
-    // construct without any RNG, so a construct the campaign skipped would
+    // Anti-vacuity complement to the campaign: sweep the full P × P × P grid
+    // per construct without any RNG, so a construct the campaign skipped would
     // still be caught here.
     for (const kind of CONSTRUCTS) {
       for (const a of P) {
         for (const b of P) {
-          const ps = kind === 'direct' ? [a] : [a, b];
+          for (const c of P) {
+          const ps = kind === 'direct' ? [a] : [a, b, c];
           const { dsl, edges, oracle, relation } = buildProgram(kind, ps);
           const arbiter = new Arbiter();
           arbiter.addNode('u:1', 'Employee');
@@ -183,6 +228,7 @@ describe('DSL generative oracle parity (rigor)', () => {
             Math.abs(result.possibility - oracle) <= EPS,
             `${kind} ps=[${ps}] check=${result.possibility}(${result.reason}) vs oracle=${oracle}`
           );
+          }
         }
       }
     }

tests/rigor/dsl-illegal-mutations.test.js

@@ -81,6 +81,21 @@ const MUTATIONS = {
     desc: 'evidence declared with mismatched parameter arity',
     mustFail: true,
     apply: () => VALID_DSL.replace('evidence can_read(user: Employee, doc: Doc) { owns(user, doc) }', 'evidence can_read(user: Employee) { owns(user, doc) }')
+  },
+  cyclic_evidence_ref: {
+    desc: 'two evidences referencing each other (cycle)',
+    mustFail: true,
+    apply: () => VALID_DSL + `
+  evidence can_cyc_a(user: Employee, doc: Doc) { can_cyc_b(user, doc) }
+  evidence can_cyc_b(user: Employee, doc: Doc) { can_cyc_a(user, doc) }`
+  },
+  cross_kind_collision: {
+    desc: 'fact and evidence sharing a relation name',
+    mustFail: true,
+    apply: () => VALID_DSL.replace(
+      'evidence can_read(user: Employee, doc: Doc) { owns(user, doc) }',
+      'fact can_read(user: Employee, doc: Doc)\n  evidence can_read(user: Employee, doc: Doc) { owns(user, doc) }'
+    )
   }
 };