feat: chain condition steps — defeasible/logical evidence as final chain hop

A chain's FINAL (object-side) step may now reference a defeasible/logical
evidence. The compiler lowers it to a condition step
({ rule: <config>, conditionStep: true }) that the engine verifies at
(intermediate, object) instead of traversing an edge. Requires
@arbiter/core@^1.0.3 (ChainRule condition-step support).

- _expandChainSteps: a logical/defeasible/comparator evidence is expressible
  as a final condition step; non-final such steps remain a compile error
  (a condition cannot discover intermediate nodes).
- Dependency collection (generator + DSLRuntime) descends into condition-step
  rule configs, so partial-graph requirements reach through them.

Tests: ChainConditionStep (defeasible + ALWAYS steps, independent checkability,
parallel aggregation), oracle campaign chain_condition_step construct
(oracle = min(pm, pv*(1-pb))), DSLRuntime transitive required facts through a
condition step.

package-lock.json

@@ -1,15 +1,15 @@
 {
   "name": "@arbiter/evidence-dsl",
-  "version": "1.1.0",
+  "version": "1.4.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@arbiter/evidence-dsl",
-      "version": "1.1.0",
+      "version": "1.4.0",
       "license": "ISC",
       "dependencies": {
-        "@arbiter/core": "^1.0.2"
+        "@arbiter/core": "^1.0.3"
       },
       "devDependencies": {
         "@rigor/core": "^3.1.0",
@@ -17,9 +17,9 @@
       }
     },
     "node_modules/@arbiter/core": {
-      "version": "1.0.2",
-      "resolved": "https://hub.kl1.tenere.ai/api/packages/Arbiter/npm/%40arbiter%2Fcore/-/1.0.2/core-1.0.2.tgz",
-      "integrity": "sha512-N1duiHy1Rlsxqpvu8uPf4tMaLOQ2tNXvGs53jLkRcIAYqafIAMvcf0BPS2iE2xVKNsqY92+F05bZZEAO5jnbyQ==",
+      "version": "1.0.3",
+      "resolved": "https://hub.kl1.tenere.ai/api/packages/Arbiter/npm/%40arbiter%2Fcore/-/1.0.3/core-1.0.3.tgz",
+      "integrity": "sha512-MCXxyeWBoYjEJMrdO8N8q9uEdX7JgDvwRH39D+8x65zFz+JCNWIQ8H4DgsP2rgF+yzv/cdVH4BX9PfFt6i0ftQ==",
       "license": "ISC",
       "dependencies": {
         "@tenere/pltc-core": "^0.6.3",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arbiter/evidence-dsl",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "description": "Evidence DSL v2 compiler: translates the natural Evidence DSL (ADR-000) into @arbiter/core relation configurations.",
   "license": "ISC",
   "type": "module",
@@ -24,7 +24,7 @@
     "generate:parser": "node scripts/generate-parser.js"
   },
   "dependencies": {
-    "@arbiter/core": "^1.0.2"
+    "@arbiter/core": "^1.0.3"
   },
   "devDependencies": {
     "@rigor/core": "^3.1.0",

src/generator/RuleGenerator.js

@@ -155,6 +155,7 @@ export class RuleGenerator {
         for (const step of rule.steps) {
           if (typeof step === 'string') targetSet.add(step);
           else if (step && typeof step.relation === 'string') targetSet.add(step.relation);
+          else if (step && step.rule) collect(step.rule, targetSet);
         }
       }
       if (rule.type === 'relational_comparator') {
@@ -1070,13 +1071,18 @@ export class RuleGenerator {
    *   - chain evidence   → splice its steps into this chain (flattening)
    *     (a step that is itself a sub-path becomes its steps, preserving the
    *      linear source→…→object traversal);
-   *   - anything else (defeasible/logical/comparator) → compile error: such a
-   *     step is a condition, not an edge traversal, and cannot lower to a flat
-   *     chain step.
+   *   - logical / defeasible / comparator evidence → only expressible as a
+   *     FINAL condition-gated step (the object is known, so the engine can
+   *     verify the condition at (intermediate, object) instead of traversing
+   *     an edge). Emitted as a `{ rule: <config> }` step the ChainRule
+   *     evaluates as a condition hop. Non-final such steps are a compile
+   *     error: a condition cannot discover intermediate nodes.
    */
   _expandChainSteps(steps, stack) {
     const out = [];
-    for (const step of steps) {
+    for (let idx = 0; idx < steps.length; idx++) {
+      const step = steps[idx];
+      const isLast = idx === steps.length - 1;
       const stepName = typeof step === 'string' ? step : step.relation;
       if (stepName && this.evidenceNames.has(stepName)) {
         if (stack.has(stepName)) {
@@ -1099,8 +1105,14 @@ export class RuleGenerator {
             out.push(...this._expandChainSteps(resolved.steps, refStack));
             continue;
           }
+          if (isLast) {
+            // Condition-gated final hop: inline the evidence's config as a
+            // rule step the engine evaluates at (intermediate, object).
+            out.push({ rule: this._deepCloneRule(resolved), conditionStep: true });
+            continue;
+          }
           this.errors.push(`Chain step '${stepName}' references an evidence with type '${resolved.type || 'logical'}'. ` +
-            'Chain steps can only reference facts, direct evidence, or chain evidence.');
+            'Only the final chain step may reference a defeasible/logical evidence (a condition-gated hop); intermediate steps must be edge traversals.');
           out.push(step);
           continue;
         }

src/runtime/DSLRuntime.js

@@ -103,7 +103,11 @@ export class DSLRuntime {
           if (rule.computedRelation) deps.add(rule.computedRelation);
         }
         if (rule.type === 'chain' && Array.isArray(rule.steps)) {
-          for (const s of rule.steps) deps.add(typeof s === 'string' ? s : s.relation);
+          for (const s of rule.steps) {
+            if (typeof s === 'string') deps.add(s);
+            else if (s && s.relation) deps.add(s.relation);
+            else if (s && s.rule) collect(s.rule);
+          }
         }
         if (rule.type === 'parent' && rule.parentRelation) deps.add(rule.parentRelation);
         if (rule.type === 'multi_hop' && rule.relation) deps.add(rule.relation);

tests/ChainConditionStep.test.js

@@ -0,0 +1,101 @@
+/**
+ * tests/ChainConditionStep.test.js — a chain whose FINAL (object-side) hop
+ * references a defeasible/logical evidence. The compiler lowers it to a
+ * condition step: `{ rule: <config>, conditionStep: true }`, which the engine
+ * verifies at (intermediate, object) rather than traversing an edge.
+ *
+ * Only the final step may be a condition (the object is known); an
+ * intermediate condition cannot discover nodes and is a compile error.
+ */
+import { describe, it } from 'node:test';
+import assert from 'node:assert/strict';
+import { Arbiter } from '@arbiter/core';
+import { DSLCompiler } from '../src/DSLCompiler.js';
+
+const DEFS = `
+  definition Employee { id: string }
+  definition Group { id: string }
+  definition Doc { id: string }
+  fact member_of(user: Employee, group: Group)
+  fact can_view(group: Group, doc: Doc)
+  fact banned(group: Group)
+  fact can_edit(group: Group, doc: Doc)
+`;
+
+function compile(dsl, name = 'chain-cond') {
+  const arb = new Arbiter();
+  const compiler = new DSLCompiler(arb);
+  const result = compiler.compile(dsl, name);
+  return { arb, result };
+}
+
+describe('Chain condition step (logical evidence as final hop)', () => {
+  it('lowers a defeasible final step to a condition step and grants', () => {
+    const { arb, result } = compile(`
+      ${DEFS}
+      evidence gated(group: Group, doc: Doc) { WHEN can_view(group, doc) UNLESS banned(group) }
+      evidence can_via(user: Employee, doc: Doc) { member_of(user, *g) { gated(g, doc) } }
+    `);
+    assert.ok(result.success, JSON.stringify(result.errors));
+    const steps = arb.relationConfigs.get('can_via').steps;
+    assert.equal(steps[0], 'member_of');
+    assert.equal(steps[1].conditionStep, true);
+    assert.equal(steps[1].rule.type, 'logical');
+    // transitive dependency collection through the condition step
+    assert.deepEqual(arb.relationConfigs.get('can_via').dependsOn, ['member_of', 'can_view', 'banned']);
+
+    arb.addNode('u:1', 'Employee'); arb.addNode('g:1', 'Group'); arb.addNode('doc:9', 'Doc');
+    arb.addRelation('u:1', 'member_of', 'g:1', { possibility: 1.0 });
+    arb.addRelation('g:1', 'can_view', 'doc:9', { possibility: 0.7 });
+    assert.equal(arb.check('u:1', 'can_via', 'doc:9').possibility, 0.7);
+
+    // banning the intermediate defeats the condition hop
+    arb.addRelation('g:1', 'banned', 'g:1', { possibility: 1.0 });
+    assert.equal(arb.check('u:1', 'can_via', 'doc:9').possibility, 0);
+  });
+
+  it('supports ALWAYS/NEVER evidence as a condition step', () => {
+    const { arb, result } = compile(`
+      ${DEFS}
+      evidence gated(group: Group, doc: Doc) { ALWAYS can_edit(group, doc) }
+      evidence can_via(user: Employee, doc: Doc) { member_of(user, *g) { gated(g, doc) } }
+    `);
+    assert.ok(result.success, JSON.stringify(result.errors));
+    const steps = arb.relationConfigs.get('can_via').steps;
+    assert.equal(steps[1].conditionStep, true);
+    arb.addNode('u:1', 'Employee'); arb.addNode('g:1', 'Group'); arb.addNode('doc:9', 'Doc');
+    arb.addRelation('u:1', 'member_of', 'g:1', { possibility: 1.0 });
+    arb.addRelation('g:1', 'can_edit', 'doc:9', { possibility: 0.6 });
+    assert.equal(arb.check('u:1', 'can_via', 'doc:9').possibility, 0.6);
+    arb.removeRelation('g:1', 'can_edit', 'doc:9');
+    assert.equal(arb.check('u:1', 'can_via', 'doc:9').possibility, 0);
+  });
+
+  it('keeps the condition evidence checkable in its own right', () => {
+    const { arb, result } = compile(`
+      ${DEFS}
+      evidence gated(group: Group, doc: Doc) { WHEN can_view(group, doc) UNLESS banned(group) }
+      evidence can_via(user: Employee, doc: Doc) { member_of(user, *g) { gated(g, doc) } }
+    `);
+    assert.ok(result.success, JSON.stringify(result.errors));
+    arb.addNode('g:1', 'Group'); arb.addNode('doc:9', 'Doc');
+    arb.addRelation('g:1', 'can_view', 'doc:9', { possibility: 0.8 });
+    assert.equal(arb.check('g:1', 'gated', 'doc:9').possibility, 0.8);
+  });
+
+  it('parallel intermediates aggregate through the condition step', () => {
+    const { arb, result } = compile(`
+      ${DEFS}
+      evidence gated(group: Group, doc: Doc) { can_view(group, doc) }
+      evidence can_via(user: Employee, doc: Doc) { member_of(user, *g) { gated(g, doc) } }
+    `);
+    assert.ok(result.success, JSON.stringify(result.errors));
+    arb.addNode('u:1', 'Employee'); arb.addNode('g:1', 'Group'); arb.addNode('g2:2', 'Group'); arb.addNode('doc:9', 'Doc');
+    arb.addRelation('u:1', 'member_of', 'g:1', { possibility: 0.5 });
+    arb.addRelation('g:1', 'can_view', 'doc:9', { possibility: 0.7 });
+    arb.addRelation('u:1', 'member_of', 'g2:2', { possibility: 1.0 });
+    arb.addRelation('g2:2', 'can_view', 'doc:9', { possibility: 0.8 });
+    // max over paths: min(0.5,0.7)=0.5, min(1.0,0.8)=0.8 -> 0.8
+    assert.equal(arb.check('u:1', 'can_via', 'doc:9').possibility, 0.8);
+  });
+});

tests/ChainStepComposition.test.js

@@ -81,14 +81,18 @@ describe('Chain step composition', () => {
     assert.equal(arb.check('u:1', 'can_via', 'doc:9').possibility, 0.6);
   });
 
-  it('rejects a defeasible/logical evidence as a chain step', () => {
-    const { result } = compile(`
+  it('lowers a logical evidence FINAL step to a condition step', () => {
+    const { arb, result } = compile(`
       ${DEFS}
       evidence gated(group: Group, doc: Doc) { WHEN can_view(group, doc) UNLESS banned(group) }
       evidence can_via(user: Employee, doc: Doc) { member_of(user, *g) { gated(g, doc) } }
     `);
-    assert.equal(result.success, false);
-    assert.ok(result.errors.some(e => /Chain step 'gated'/.test(e)), JSON.stringify(result.errors));
+    assert.ok(result.success, JSON.stringify(result.errors));
+    // final-step logical evidence → condition step (verified at the object)
+    const steps = arb.relationConfigs.get('can_via').steps;
+    assert.equal(steps[0], 'member_of');
+    assert.equal(steps[1].conditionStep, true);
+    assert.equal(steps[1].rule.type, 'logical');
   });
 
   it('rejects a mutual cycle through chain steps', () => {

tests/DSLRuntime.test.js

@@ -188,4 +188,21 @@ describe('DSLRuntime', () => {
     assert.equal(denied.possibility, 0);
     assert.equal(denied.reason, 'defeated_by_unless');
   });
+
+  it('derives transitive required facts through a condition-step chain', () => {
+    const dsl = `
+      definition Employee { id: string }
+      definition Group { id: string }
+      definition Doc { id: string }
+      fact *member_of(user: Employee, group: Group)
+      fact *can_view(group: Group, doc: Doc)
+      fact *banned(group: Group)
+      evidence gated(group: Group, doc: Doc) { WHEN can_view(group, doc) UNLESS banned(group) }
+      evidence can_via(user: Employee, doc: Doc) { member_of(user, *g) { gated(g, doc) } }
+    `;
+    const rt = new DSLRuntime(new Arbiter()).compile(dsl, 'rt-cond');
+    // The condition step's facts (can_view, banned) reach through to the
+    // evidence's requirements, alongside the edge-traversal fact.
+    assert.deepEqual(rt.requiredFacts('can_via'), ['member_of', 'can_view', 'banned']);
+  });
 });

tests/rigor/dsl-generative-oracle.test.js

@@ -34,6 +34,7 @@ const FACTS = `
   fact granted(user: Employee, doc: Doc)
   fact group_perm(group: Group, doc: Doc)
   fact banned(user: Employee)
+  fact group_banned(group: Group)
   fact mfa(user: Employee)
 `;
 
@@ -128,6 +129,19 @@ function buildProgram(kind, ps) {
       oracle = Math.min(pm, pv);
       break;
     }
+    case 'chain_condition_step': {
+      // gated (a defeasible evidence) as the FINAL chain step → a condition
+      // step: the engine verifies gated at (intermediate, object). The oracle
+      // is the chain's min combined with the condition's base*(1-defeat).
+      const [pm, pv, pb] = ps;
+      evidence = `evidence gated(group: Group, doc: Doc) { WHEN group_perm(group, doc) UNLESS group_banned(group) }
+                  evidence can_via(user: Employee, doc: Doc) { member_of(user, *g) { gated(g, doc) } }`;
+      edges.push({ src: 'u:1', relation: 'member_of', dst: 'g:1', possibility: pm });
+      edges.push({ src: 'g:1', relation: 'group_perm', dst: 'doc:9', possibility: pv });
+      edges.push({ src: 'g:1', relation: 'group_banned', dst: 'g:1', possibility: pb });
+      oracle = Math.min(pm, pv * (1 - pb));
+      break;
+    }
     default:
       throw new Error(`unknown construct: ${kind}`);
   }
@@ -163,7 +177,8 @@ function runCheck({ kind, ps }) {
 }
 
 const CONSTRUCTS = ['direct', 'chain', 'tuple_to_userset', 'fusion_min', 'fusion_max',
-  'when_unless', 'never_always', 'requires_when', 'composition', 'chain_step_composition'];
+  'when_unless', 'never_always', 'requires_when', 'composition', 'chain_step_composition',
+  'chain_condition_step'];
 
 describe('DSL generative oracle parity (rigor)', () => {
   it('generated legal DSL compiles and every check matches the oracle', async () => {
@@ -174,7 +189,7 @@ describe('DSL generative oracle parity (rigor)', () => {
             kind: rigor.gen.oneOf(CONSTRUCTS),
             // exactly two edge possibilities (direct uses only the first);
             // a shorter array would leave pB undefined and produce a NaN oracle
-            ps: rigor.gen.tuple(rigor.gen.oneOf(P), rigor.gen.oneOf(P))
+            ps: rigor.gen.tuple(rigor.gen.oneOf(P), rigor.gen.oneOf(P), rigor.gen.oneOf(P))
           })
         ))
       ],
@@ -192,13 +207,14 @@ describe('DSL generative oracle parity (rigor)', () => {
   });
 
   it('exhaustive deterministic sweep: every construct x every possibility value', () => {
-    // Anti-vacuity complement to the campaign: sweep the full P × P grid per
-    // construct without any RNG, so a construct the campaign skipped would
+    // Anti-vacuity complement to the campaign: sweep the full P × P × P grid
+    // per construct without any RNG, so a construct the campaign skipped would
     // still be caught here.
     for (const kind of CONSTRUCTS) {
       for (const a of P) {
         for (const b of P) {
-          const ps = kind === 'direct' ? [a] : [a, b];
+          for (const c of P) {
+          const ps = kind === 'direct' ? [a] : [a, b, c];
           const { dsl, edges, oracle, relation } = buildProgram(kind, ps);
           const arbiter = new Arbiter();
           arbiter.addNode('u:1', 'Employee');
@@ -212,6 +228,7 @@ describe('DSL generative oracle parity (rigor)', () => {
             Math.abs(result.possibility - oracle) <= EPS,
             `${kind} ps=[${ps}] check=${result.possibility}(${result.reason}) vs oracle=${oracle}`
           );
+          }
         }
       }
     }

tests/rigor/dsl-illegal-mutations.test.js

@@ -96,14 +96,6 @@ const MUTATIONS = {
       'evidence can_read(user: Employee, doc: Doc) { owns(user, doc) }',
       'fact can_read(user: Employee, doc: Doc)\n  evidence can_read(user: Employee, doc: Doc) { owns(user, doc) }'
     )
-  },
-  non_lowerable_chain_step: {
-    desc: 'a defeasible evidence used as a chain step (cannot lower to an edge)',
-    mustFail: true,
-    apply: () => VALID_DSL.replace(
-      'evidence can_enter(user: Employee, doc: Doc) { member_of(user, *g) { can_access(g, doc) } }',
-      'evidence can_gated(group: Group, doc: Doc) { WHEN can_access(group, doc) UNLESS banned(group) }\n  evidence can_enter(user: Employee, doc: Doc) { member_of(user, *g) { can_gated(g, doc) } }'
-    ).replace('fact can_access(group: Group, doc: Doc)', 'fact can_access(group: Group, doc: Doc)\n  fact banned(group: Group)')
   }
 };