@astrale-os/kernel-core 1.0.0-beta.1 → 1.0.0-beta.3

package/dist/auth/authority/index.d.ts

@@ -8,5 +8,5 @@ export { limits } from './admission/index.js';
 export { canonicalize } from './normalization/index.js';
 export { AUTHORITY_PREDICATE_VERSION, AUTHORITY_PROGRAM_VERSION } from './language/index.js';
 export type { AuthorityExpr, AuthorityPredicate, AuthorityProgram, ClassRef, ClosedEdgeExtent, Input, LocalDeclaration, Operation, PredicateRef, Repeat, Requirement, Term, } from './language/index.js';
-export { AuthorityFailure, allowed, binderRoots, classAuthorityMeaning, closeComposition, createAuthorityEvaluator, fixedPaths, isFixedTerm, requiredInputs, termPath, } from './semantics/index.js';
-export type { AuthorityAtom, AuthorityEvaluationOptions, AuthorityEvaluator, AuthorityFailureCode, AuthorityInputs, AuthorityNode, AuthoritySnapshot, AuthorityVocabulary, CompositionClosure, CompositionLimits, CompositionStatus, FixedTerm, } from './semantics/index.js';
+export { AuthorityFailure, allowed, binderRoots, classAuthorityMeaning, closeComposition, createAuthorityEvaluator, fixedPaths, isFixedTerm, requiredInputs, residualProgram, staticAtoms, termPath, } from './semantics/index.js';
+export type { AuthorityAtom, AuthorityEvaluationOptions, AuthorityEvaluator, AuthorityFailureCode, AuthorityInputs, AuthorityNode, AuthoritySnapshot, AuthorityVocabulary, CompositionClosure, CompositionLimits, CompositionStatus, FixedTerm, StaticAtom, } from './semantics/index.js';

package/dist/auth/authority/index.js

@@ -6,4 +6,4 @@ export { acceptProgram, createAuthorityProgram, isPredicateRef } from './program
 export { limits } from './admission/index.js';
 export { canonicalize } from './normalization/index.js';
 export { AUTHORITY_PREDICATE_VERSION, AUTHORITY_PROGRAM_VERSION } from './language/index.js';
-export { AuthorityFailure, allowed, binderRoots, classAuthorityMeaning, closeComposition, createAuthorityEvaluator, fixedPaths, isFixedTerm, requiredInputs, termPath, } from './semantics/index.js';
+export { AuthorityFailure, allowed, binderRoots, classAuthorityMeaning, closeComposition, createAuthorityEvaluator, fixedPaths, isFixedTerm, requiredInputs, residualProgram, staticAtoms, termPath, } from './semantics/index.js';

package/dist/auth/authority/semantics/composition.d.ts

@@ -28,6 +28,13 @@ export interface CompositionClosure {
      * decided. Undefined when the closure is cyclic.
      */
     status(leaf: (identity: NodeId) => boolean): CompositionStatus | undefined;
+    /**
+     * The binder's decision, `allowed` of `status`, from leaves of which some are unknown
+     * (undefined): the same fold in Kleene's strong three-valued logic, so a decision it returns is
+     * the one every value of the unknown leaves gives (`decide3_sound` of `proofs/Authority.lean`).
+     * Undefined when they can change it. A cyclic closure is false.
+     */
+    decide(leaf: (identity: NodeId) => boolean | undefined): boolean | undefined;
 }
 /** A binder admits its Identity when its composed status is positive and not denied. */
 export declare function allowed(status: CompositionStatus): boolean;

package/dist/auth/authority/semantics/composition.js

@@ -61,27 +61,65 @@ export function closeComposition(root, snapshot, vocabulary, identities, limits)
         status(leaf) {
             if (!acyclic)
                 return undefined;
-            const values = [];
-            // Iterative in the dependency order, so a deep valid composition needs no call stack.
-            for (const ordinal of order) {
-                const row = children[ordinal];
-                const truth = leaf(members[ordinal]);
-                const full = (child) => values[child].full;
-                const positive = (child) => values[child].positive;
-                const denied = (child) => values[child].denied;
-                values[ordinal] = Object.freeze({
-                    full: (truth || row.extensions.some(full)) &&
-                        row.constraints.every(full) &&
-                        !row.exclusions.some(full),
-                    positive: (truth || row.extensions.some(positive)) && row.constraints.every(positive),
-                    denied: row.exclusions.some(full) ||
-                        row.extensions.some(denied) ||
-                        row.constraints.some(denied),
-                });
-            }
-            return values[0];
+            // Known leaves keep every value of the fold known.
+            const status = fold(leaf);
+            return Object.freeze({
+                full: status.full === true,
+                positive: status.positive === true,
+                denied: status.denied === true,
+            });
+        },
+        decide(leaf) {
+            if (!acyclic)
+                return false;
+            const status = fold(leaf);
+            return and(status.positive, not(status.denied));
         },
     });
+    /**
+     * The composed status of the root, children first, in Kleene's strong three-valued logic: an
+     * unknown leaf (undefined) leaves unknown only what it can change, and known leaves keep every
+     * value known. Iterative in the dependency order, so a deep valid composition needs no call
+     * stack; every member's leaf is decided once.
+     */
+    function fold(leaf) {
+        const values = [];
+        // The children's `field`, combined by `or` when `absorbing` is true and by `and` otherwise.
+        const combine = (list, field, absorbing) => {
+            let result = !absorbing;
+            for (const child of list) {
+                const truth = values[child][field];
+                if (truth === absorbing)
+                    return absorbing;
+                if (truth === undefined)
+                    result = undefined;
+            }
+            return result;
+        };
+        for (const ordinal of order) {
+            const { extensions, constraints, exclusions } = children[ordinal];
+            const truth = leaf(members[ordinal]);
+            values[ordinal] = {
+                full: and(and(or(truth, combine(extensions, 'full', true)), combine(constraints, 'full', false)), not(combine(exclusions, 'full', true))),
+                positive: and(or(truth, combine(extensions, 'positive', true)), combine(constraints, 'positive', false)),
+                denied: or(or(combine(exclusions, 'full', true), combine(extensions, 'denied', true)), combine(constraints, 'denied', true)),
+            };
+        }
+        return values[0];
+    }
+}
+function and(left, right) {
+    if (left === false || right === false)
+        return false;
+    return left === undefined || right === undefined ? undefined : true;
+}
+function or(left, right) {
+    if (left === true || right === true)
+        return true;
+    return left === undefined || right === undefined ? undefined : false;
+}
+function not(value) {
+    return value === undefined ? undefined : !value;
 }
 /** Kahn order over the closure; shorter than the closure exactly when it contains a cycle. */
 function childrenFirst(children) {

package/dist/auth/authority/semantics/index.d.ts

@@ -5,6 +5,8 @@ export { AuthorityFailure } from './failure.js';
 export type { AuthorityFailureCode } from './failure.js';
 export { binderRoots, createAuthorityEvaluator } from './interpret.js';
 export type { AuthorityAtom, AuthorityEvaluationOptions, AuthorityEvaluator } from './interpret.js';
+export { residualProgram, staticAtoms } from './residual.js';
+export type { StaticAtom } from './residual.js';
 export type { AuthorityInputs, AuthorityNode, AuthoritySnapshot } from './snapshot.js';
 export { fixedPaths, isFixedTerm, requiredInputs, termPath } from './terms.js';
 export type { FixedTerm } from './terms.js';

package/dist/auth/authority/semantics/index.js

@@ -2,4 +2,5 @@ export { classAuthorityMeaning } from './class-authority.js';
 export { allowed, closeComposition } from './composition.js';
 export { AuthorityFailure } from './failure.js';
 export { binderRoots, createAuthorityEvaluator } from './interpret.js';
+export { residualProgram, staticAtoms } from './residual.js';
 export { fixedPaths, isFixedTerm, requiredInputs, termPath } from './terms.js';

package/dist/auth/authority/semantics/residual.d.ts

@@ -0,0 +1,32 @@
+import type { NodeId } from '../../../graph/node/index.js';
+import type { AuthorityExpr, AuthorityProgram } from '../language/index.js';
+import type { CompositionClosure } from './composition.js';
+import type { AuthorityAtom } from './interpret.js';
+/**
+ * An atom outside every existential scope that reads no input: one snapshot gives it one value,
+ * one per subject when it names the subject of its binder (`subject`).
+ */
+export interface StaticAtom {
+    readonly atom: AuthorityAtom;
+    readonly subject: boolean;
+}
+/**
+ * The static atoms of the expressions, each once by structure, in depth-first order: the atoms
+ * `residualProgram` asks to decide. An `exists` that reads no input is one atom.
+ */
+export declare function staticAtoms(expressions: readonly AuthorityExpr[]): readonly StaticAtom[];
+/**
+ * The program specialized to one snapshot: each static atom replaced by the value `atom` gives it,
+ * and each expression those values decide folded into it, in Kleene's strong three-valued logic.
+ * `atom` receives the subject only for an atom that names it, and undefined leaves the atom in
+ * place. A binder whose composition decides it from its members' specialized leaves
+ * (`CompositionClosure.decide`) is folded too. Otherwise it keeps the leaf every member
+ * specializes to alike, or the leaf specialized without a subject. `closure` is the admitted
+ * composition of a binder root.
+ *
+ * Once the program is admitted in that snapshot (AUTH-FAILURE-ADMITTED-EAGERLY), the residual
+ * decides every input frame as the program does (`pe_sound` of `proofs/Authority.lean`). Each
+ * member keeps its ordinal, so the residual is not canonical, and an expression nothing decides
+ * stays the same object.
+ */
+export declare function residualProgram(program: AuthorityProgram, closure: (root: NodeId) => CompositionClosure | undefined, atom: (atom: AuthorityAtom, subject: NodeId | undefined) => boolean | undefined): AuthorityProgram;

package/dist/auth/authority/semantics/residual.js

@@ -0,0 +1,166 @@
+import { ownTerms, requiredInputs } from './terms.js';
+/**
+ * The static atoms of the expressions, each once by structure, in depth-first order: the atoms
+ * `residualProgram` asks to decide. An `exists` that reads no input is one atom.
+ */
+export function staticAtoms(expressions) {
+    const found = new Map();
+    const visit = (value) => {
+        switch (value.op) {
+            case 'true':
+            case 'false':
+                return;
+            case 'all':
+            case 'any':
+                value.predicates.forEach(visit);
+                return;
+            case 'not':
+                visit(value.predicate);
+                return;
+            case 'as':
+                visit(value.where);
+                return;
+            default: {
+                const subject = names(value);
+                const key = JSON.stringify(value);
+                if (subject !== undefined && !found.has(key))
+                    found.set(key, { atom: value, subject });
+            }
+        }
+    };
+    expressions.forEach(visit);
+    return Object.freeze([...found.values()]);
+}
+/**
+ * The program specialized to one snapshot: each static atom replaced by the value `atom` gives it,
+ * and each expression those values decide folded into it, in Kleene's strong three-valued logic.
+ * `atom` receives the subject only for an atom that names it, and undefined leaves the atom in
+ * place. A binder whose composition decides it from its members' specialized leaves
+ * (`CompositionClosure.decide`) is folded too. Otherwise it keeps the leaf every member
+ * specializes to alike, or the leaf specialized without a subject. `closure` is the admitted
+ * composition of a binder root.
+ *
+ * Once the program is admitted in that snapshot (AUTH-FAILURE-ADMITTED-EAGERLY), the residual
+ * decides every input frame as the program does (`pe_sound` of `proofs/Authority.lean`). Each
+ * member keeps its ordinal, so the residual is not canonical, and an expression nothing decides
+ * stays the same object.
+ */
+export function residualProgram(program, closure, atom) {
+    const subjects = new Map();
+    const binders = new Map();
+    const known = (value, subject) => {
+        let named = subjects.get(value);
+        if (named === undefined)
+            subjects.set(value, (named = names(value) ?? null));
+        if (named === null)
+            return undefined;
+        if (!named)
+            return atom(value, undefined);
+        return subject === undefined ? undefined : atom(value, subject);
+    };
+    const specialize = (value, subject) => {
+        switch (value.op) {
+            case 'true':
+            case 'false':
+                return value;
+            case 'all':
+            case 'any': {
+                // `all` is false once one member is, `any` true once one member is.
+                const absorbing = value.op === 'any';
+                const kept = [];
+                let changed = false;
+                for (const child of value.predicates) {
+                    const residual = specialize(child, subject);
+                    const decided = truth(residual);
+                    if (decided === absorbing)
+                        return constant(absorbing);
+                    if (decided === undefined)
+                        kept.push(residual);
+                    if (residual !== child || decided !== undefined)
+                        changed = true;
+                }
+                if (!changed)
+                    return value;
+                if (kept.length === 0)
+                    return constant(!absorbing);
+                return kept.length === 1 ? kept[0] : Object.freeze({ op: value.op, predicates: kept });
+            }
+            case 'not': {
+                const residual = specialize(value.predicate, subject);
+                const decided = truth(residual);
+                if (decided !== undefined)
+                    return constant(!decided);
+                return residual === value.predicate
+                    ? value
+                    : Object.freeze({ op: 'not', predicate: residual });
+            }
+            case 'as': {
+                // A binder names its own subject: its residual is the same under every outer subject.
+                let residual = binders.get(value);
+                if (residual === undefined)
+                    binders.set(value, (residual = binder(value)));
+                return residual;
+            }
+            default: {
+                const decided = known(value, subject);
+                return decided === undefined ? value : constant(decided);
+            }
+        }
+    };
+    const binder = (value) => {
+        const composed = closure(value.identity);
+        if (composed === undefined)
+            return value;
+        const leaves = new Map(composed.identities.map((member) => [member, specialize(value.where, member)]));
+        const decided = composed.decide((member) => truth(leaves.get(member)));
+        if (decided !== undefined)
+            return constant(decided);
+        const [first, ...others] = leaves.values();
+        // Each member's leaf decides as its own specialization: one shared by every member replaces
+        // the leaf; otherwise only what no subject decides is specialized.
+        const where = others.every((leaf) => same(leaf, first))
+            ? first
+            : specialize(value.where, undefined);
+        return where === value.where ? value : Object.freeze({ ...value, where });
+    };
+    const predicates = program.predicates.map((predicate) => specialize(predicate, undefined));
+    if (predicates.every((predicate, index) => predicate === program.predicates[index])) {
+        return program;
+    }
+    return Object.freeze({ ...program, predicates: Object.freeze(predicates) });
+}
+const TRUE = Object.freeze({ op: 'true' });
+const FALSE = Object.freeze({ op: 'false' });
+function constant(value) {
+    return value ? TRUE : FALSE;
+}
+function truth(value) {
+    return value.op === 'true' ? true : value.op === 'false' ? false : undefined;
+}
+function same(left, right) {
+    return left === right || JSON.stringify(left) === JSON.stringify(right);
+}
+/**
+ * Undefined when the atom reads a decision input (`requiredInputs`); otherwise whether it names the
+ * subject of its binder, outside the binders nested in it.
+ */
+function names(atom) {
+    if (requiredInputs([atom]).size > 0)
+        return undefined;
+    const subject = (value) => {
+        switch (value.op) {
+            case 'all':
+            case 'any':
+                return value.predicates.some(subject);
+            case 'not':
+                return subject(value.predicate);
+            case 'as':
+                return false;
+            case 'exists':
+                return subject(value.where);
+            default:
+                return ownTerms(value).some((term) => term.kind === 'subject');
+        }
+    };
+    return subject(atom);
+}

package/dist/auth/authority/semantics/terms.d.ts

@@ -18,3 +18,5 @@ export declare function fixedPaths(expressions: readonly AuthorityExpr[]): reado
  * `edge-class` reads. A decision whose frame leaves one of them unbound fails.
  */
 export declare function requiredInputs(expressions: readonly AuthorityExpr[]): ReadonlySet<keyof AuthorityInputs>;
+/** The terms one expression reads itself, excluding those of its nested expressions. */
+export declare function ownTerms(expression: AuthorityExpr): readonly Term[];

package/dist/auth/authority/semantics/terms.js

@@ -70,7 +70,7 @@ function* subexpressions(expressions) {
     }
 }
 /** The terms one expression reads itself, excluding those of its nested expressions. */
-function ownTerms(expression) {
+export function ownTerms(expression) {
     switch (expression.op) {
         case 'same-node':
             return [expression.left, expression.right];

package/dist/schema/authority/authority-relation.js

@@ -12,5 +12,8 @@ export function authorityRelation(target, role, description) {
         target: { as: role, accepts: [target], incoming: '0..*' },
         description,
         extends: [Edge],
+        // The installed authority map is observed through Identity.can, never read wholesale: only the
+        // Kernel Domain and Root read its Edges.
+        policies: { read: false, traverse: false },
     });
 }

package/dist/schema/callables/execution.js

@@ -11,12 +11,14 @@ const nodeId = {
 // mutation cannot create an Execution, change its Properties or rewrite its created_by Edge; its
 // authority Domain deletes it by ordinary mutation. `function` is a scalar, not an Edge, so deleting
 // the Function never has to detach its Executions. State and outcome are read through the engine.
-// No Class Policy: Runtime admits every Execution method against these facts, and a relational
-// read Policy here would join every polymorphic Query reaching Node or Timestamped.
+// Runtime admits every Execution method against these facts; a public read sees none of them, since
+// `input` carries the arguments of the call. The constant rule joins nothing, where a relational
+// read Policy would join every polymorphic Query reaching Node or Timestamped.
 export const Execution = nodeClass({
     abstract: false,
     description: 'One accepted durable call of a Function, recorded as immutable facts.',
     extends: [Node, Timestamped],
+    policies: { read: false, traverse: false },
     properties: {
         function: nodeId,
         version: { type: 'string', fullMatch: 'sha256:[0-9a-f]{64}' },

package/dist/schema/kernel/schema.d.ts

@@ -9446,17 +9446,6 @@ export declare const KernelRootFunctions: readonly ((import("@astrale-os/kernel-
     };
     readonly key: "kernel.astrale.ai:function.upload";
     readonly execution: undefined;
-}) | (import("@astrale-os/kernel-dsl/v1").ResolvedMethod<{
-    audience?: string | undefined;
-    ttlSeconds: number;
-    identity: string;
-}, {
-    readonly mode: 'value';
-    readonly value: string;
-}, true, false, "authorized", import("@astrale-os/kernel-dsl/v1").CallablePolicy, "kernel.astrale.ai:class.Identity.method.impersonate"> & {
-    readonly name: "impersonate";
-    readonly executable: true;
-    readonly execution: undefined;
 }) | (import("@astrale-os/kernel-dsl/v1").ResolvedMethod<{
     iss: string;
     sub: string;
@@ -9516,6 +9505,17 @@ export declare const KernelRootFunctions: readonly ((import("@astrale-os/kernel-
     readonly name: "resolve";
     readonly executable: true;
     readonly execution: undefined;
+}) | (import("@astrale-os/kernel-dsl/v1").ResolvedMethod<{
+    audience?: string | undefined;
+    ttlSeconds: number;
+    identity: string;
+}, {
+    readonly mode: 'value';
+    readonly value: string;
+}, true, false, "authorized", import("@astrale-os/kernel-dsl/v1").CallablePolicy, "kernel.astrale.ai:class.Identity.method.impersonate"> & {
+    readonly name: "impersonate";
+    readonly executable: true;
+    readonly execution: undefined;
 }))[];
 export { AuthorityOperationOrder, AuthorityOperations, operationOf } from '../authority/index.js';
 export type { AuthorityOperation, AuthorityRelation } from '../authority/index.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrale-os/kernel-core",
-  "version": "1.0.0-beta.1",
+  "version": "1.0.0-beta.3",
   "description": "Astrale Kernel Core - Types, Invariants, and Pure Logic",
   "license": "Apache-2.0",
   "repository": {
@@ -160,7 +160,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@astrale-os/kernel-dsl": "1.0.0-beta.1",
+    "@astrale-os/kernel-dsl": "1.0.0-beta.2",
     "@noble/hashes": "2.3.0",
     "@types/json-schema": "^7.0.15",
     "dequal": "2.0.3"