@crediolabs/policy-synth 0.1.17 → 0.2.0

package/README.md

@@ -1,272 +1,70 @@
 # @crediolabs/policy-synth
 
-Off-chain TypeScript synthesis core for the OpenZeppelin Accounts Policy Builder.
+Off-chain synthesis core for the OctoGate policy layer on Stellar. It turns a
+transaction you recorded, or a mandate you can state in one sentence, into the
+minimal on-chain policy that permits exactly that flow, then verifies,
+simulates, and packages it for installation on an
+[OpenZeppelin Stellar smart account](https://docs.openzeppelin.com/stellar-contracts).
 
-It records a Soroban transaction (from an on-chain hash or a raw envelope XDR),
-synthesises the **minimal** policy that permits exactly that flow, and compiles it
-through the OZ Accounts adapter into a proposed policy. When the policy needs
-constraint shapes OZ built-ins cannot express (exact ordered swap paths, oracle
-price bounds, per-method scoping, recipient allowlists), the **interpreter
-adapter** is opted in to emit a parallel predicate-shaped `PolicyDocument` that
-installs alongside the OZ primitives. The synthesis is self-verified end-to-end
-via `simulatePolicy` / `verifyPolicy` and the runner of the deny-case harness
-before any bytes are emitted.
-
-The package is pure ESM, node-compatible, and has a single runtime dependency
-(`@stellar/stellar-sdk`). MIT-licensed.
+The on-chain half is the `policy-interpreter` Soroban contract, which lives in
+the same repository:
+[untangledfinance/octogate](https://github.com/untangledfinance/octogate).
 
 ## Install
 
 ```sh
 npm install @crediolabs/policy-synth
+# or
+bun add @crediolabs/policy-synth
 ```
 
-## Usage
-
-There are two front-ends, both co-equal:
-
-- **Recording** — decode a real transaction, then infer the minimal policy.
-- **Mandate** — a declarative spec that lowers deterministically (no inference).
-
-```ts
-import {
-  recordTransaction,
-  synthesizeFromRecording,
-  synthesizeFromMandate,
-  placeholderOzConfig,
-  type MandateSpec,
-} from '@crediolabs/policy-synth'
-
-const oz = placeholderOzConfig('mainnet')
-
-// --- Recording front-end -------------------------------------------------
-const recorded = await recordTransaction({ network: 'mainnet', hash: '<tx-hash>' })
-if (!recorded.ok) throw new Error(recorded.error.message)
-
-const inferred = synthesizeFromRecording(recorded.data, { network: 'mainnet' }, oz)
-if (inferred.ok) console.log(inferred.data)
-
-// --- Mandate front-end (deterministic) -----------------------------------
-const spec: MandateSpec = {
-  chain: 'stellar',
-  contract: 'CTOKEN',
-  method: 'transfer',
-  spendingLimit: { token: 'CTOKEN', limit: '5000000', windowSeconds: 2592000 },
-}
-const deterministic = synthesizeFromMandate(spec, oz)
-if (deterministic.ok) console.log(deterministic.data)
-```
-
-Every entry point returns a discriminated `ToolResponse<T>`:
-
-```ts
-type ToolResponse<T> = { ok: true; data: T } | { ok: false; error: ToolError }
-```
-
-`ToolError` carries a machine-readable `code`, a `message`, a `severity`, and a
-`retryable` flag, so callers (and agents) can branch without parsing prose.
-
-### Recording modes and the confidence gate
-
-- **On-chain** (`hash` set): fetched via the injected RPC fetcher (default: the
-  public Soroban RPC for the requested `network`). Pass your own `fetcher` to use
-  a custom endpoint or to test offline.
-- **Simulation / XDR** (`xdr` set): the envelope XDR is decoded directly.
+## What it does
 
-XDR/simulation mode has no raw on-chain events, so the recorder cannot run its
-events cross-check and lowers `parseConfidence`. It therefore **fails closed** at
-the default threshold; to accept a simulation-only recording, pass an explicit
-`confidenceOverride` that clears the gate.
+The `@crediolabs/policy-synth/run` entry point exposes the seven tool bodies
+that also back the CLI and the MCP server:
 
-## Interpreter predicate emission (the `interpreter` opt-in)
-
-OZ built-ins express spending limits, simple thresholds, and weighted
-thresholds. They **cannot** express an exact ordered swap path, an oracle
-price bound, per-method scoping, a recipient allowlist, or an
-invocation-count window. The recording path surfaces those gaps as warnings
-by default ("Not covered by OZ built-in primitives: ..."). When the caller
-opts in to the **interpreter adapter**, the same constraint set is routed to
-the parallel interpreter IR; the adapter compiles it into a canonical
-predicate `PolicyDocument` and merges it with the OZ refs. The byte blob on
-the wire is the canonical XDR the on-chain interpreter will consume.
-
-The opt-in is purely additive — every `ToolResponse` shape is unchanged; the
-two new fields are `policyDocuments` (the predicate-shaped interpreter doc)
-and one `policyRef` of `kind: 'interpreter'`.
+| Function | Purpose |
+| --- | --- |
+| `runRecordTransaction` | Decode a Soroban transaction (on-chain hash or base64 envelope XDR) into a `RecordedTransaction`. |
+| `runSynthesizePolicy` | Synthesise a `ProposedPolicy` from a recording or a deterministic `MandateSpec`. |
+| `runSimulatePolicy` | Replay a recording against a proposed predicate and run the deny-case battery. |
+| `runVerifyPolicy` | Static minimality check: every conjunct must be load-bearing. |
+| `runInstallPolicy` | Build the unsigned `add_context_rule` transaction XDR for the smart account. |
+| `runRevokePolicy` | Build the unsigned `remove_context_rule` transaction XDR. |
+| `runGetInterpreterInfo` | Report the pinned interpreter address, grammar version and wasm sha256, optionally checked live over RPC. |
 
 ```ts
-import { Address } from '@stellar/stellar-sdk'
-import {
-  synthesizeFromRecording,
-  placeholderOzConfig,
-} from '@crediolabs/policy-synth'
-
-const oz = placeholderOzConfig('mainnet')
-const smartAccount = Address.contract(Buffer.alloc(32, 0xee)).toString()
-
-const result = synthesizeFromRecording(
-  recordedTx,
-  {
-    network: 'mainnet',
-    userResponses: {
-      windowSeconds: 2592000,                    // 30 days
-      limitAmount: '1000000000',                 // supplied cap
-      validUntilLedger: 200000000,               // future ledger
-      oraclePriceBound: [                        // optional oracle bound
-        { asset: 'CEURC', operator: 'lt', value: '1000000000' },
-      ],
-      swapRecipientAllowlist: ['GOWNER'],        // optional allowlist
-    },
-    interpreter: {
-      smartAccountAddress: smartAccount,         // MUST be a C... contract address
-      installNonce: 1,                           // first install -> 1
-      // oracleParams: { maxStalenessSeconds: 60, maxDeviationBps: 100 }
-      // (tighten-only vs the wasm defaults; widening is rejected)
-    },
-  },
-  oz
-)
-
-if (result.ok) {
-  console.log(result.data.policyDocuments.length)  // >= 1 when constraints are routable
-  const interpreterRef = result.data.policyRefs.find((r) => r.kind === 'interpreter')
-  console.log(interpreterRef?.predicateBlobBase64) // canonical XDR, base64
-  console.log(result.data.contextRule.validUntilLedger)
-}
-```
-
-The interpreter compile path is **fail-closed**:
-
-- `SCOPE_SELF_CALL` — the call's recipient equals the smart account.
-- `ORACLE_LEAF_INVALID_POSITION` — an oracle leaf is wrongly nested.
-- `ORACLE_PARAMS_OUT_OF_RANGE` — `oracleParams` widening vs the wasm defaults.
-- `SYNTHESIS_ERROR` — the interpreter IR is not fully covered.
-- `DENY_CASE_FAILURE` — the emitted predicate fails the deny-case battery;
-  `details.failures` lists the flipped dimension(s).
-
-A recorded swap that compiles to a permissive policy under OZ alone therefore
-stays permissive unless the interpreter opt-in is supplied AND the predicate
-self-verifies end-to-end.
+import { runRecordTransaction, runSynthesizePolicy } from '@crediolabs/policy-synth/run'
 
-### Self-verify + minimise (always-on with the opt-in)
-
-Opting in to the interpreter also turns on the **self-verify pipeline**:
-
-1. The adapter emits the candidate predicate.
-2. The synth builds a permit `EvalContext` from the recorded transaction (the
-   only call the user actually performed).
-3. The candidate is **minimised** — load-bearing-free top-level conjuncts are
-   dropped (`and` predicates only; other shapes are returned unchanged).
-4. The minimised predicate is run through the deny-case battery — a structural
-   fingerprint across `contract`, `function`, `args`, `amount`, `window`,
-   `oracle`, `recipient`, `frequency`. Each case must deny.
-5. The intended recorded call is evaluated against the predicate; it must
-   permit.
-6. The (possibly minimised) predicate is re-encoded; the canonical bytes + the
-   SHA-256 hash are stamped back onto the `PolicyDocument` and the
-   `interpreter` `policyRef`.
-
-A successful `ok: true` is the proof that the emitted document is minimal AND
-self-verified. A failure surfaces the matching gate code (see above).
-
-## Simulate and verify (the `verify/` surface)
-
-The same self-verify pipeline is exposed as a public API for callers that want
-to re-run a check on a proposed predicate without re-synthesising:
-
-```ts
-import { simulatePolicy, verifyPolicy } from '@crediolabs/policy-synth'
-
-// Runtime check: re-evaluate the predicate against the recorded call.
-const runtime = simulatePolicy(predicate, recordedTx, {
-  validUntilLedger: 200000000,
-  oraclePricesByAsset: { CEURC: { price: '999999999', timestampSeconds: now } },
+const recorded = await runRecordTransaction({
+  network: 'testnet',
+  hash: '<transaction hash>',
 })
-
-// Static minimality check: prove no top-level conjunct is load-bearing-free.
-const staticCheck = verifyPolicy(predicate, recordedTx)
-```
-
-The boundary is pinned:
-
-- `SIMULATION_ERROR` — runtime evaluation failed (malformed fixture, missing
-  oracle price, uncontrolled throw). The policy may still be minimal.
-- `VERIFICATION_FAILED` — the static minimality check failed. The policy is
-  structurally over-broad regardless of how any concrete call evaluates.
-
-Both are deterministic: same `(predicate, recordedTx, opts)` → byte-identical
-envelope.
-
-## Review-card (the human-audit surface)
-
-The package emits a deterministic review-card summary so a human auditor can
-sanity-check the inferred policy without re-running the synthesis:
-
-```ts
-import {
-  buildReviewCardSummary,
-  classifyConflict,
-  summaryCrossCheck,
-} from '@crediolabs/policy-synth'
-
-const summary = buildReviewCardSummary(proposedPolicy, recordedTx)
-const conflict = classifyConflict(proposedPolicy, recordedTx)
-const crossCheck = summaryCrossCheck(proposedPolicy, recordedTx)
-```
-
-The summary is the canonical human-readable digest of the proposed policy;
-`classifyConflict` flags refs that contradict the recording; `summaryCrossCheck`
-re-derives the summary from the raw refs and the recording, and reports
-discrepancies. All three are pure and deterministic.
-
-## Codegen escape hatch (the Rust interpreter)
-
-When the canonical verifier is unavailable, the recorder can emit a Rust
-source file that performs the same predicate evaluation off-chain via a
-`cargo` build. The escape hatch is OUT of the audited happy path: the
-synthesiser never calls `generateRust` itself; the CLI subcommand is the only
-entry point.
-
-```ts
-import { generateRust, compileCheck, hasRustToolchain } from '@crediolabs/policy-synth'
-
-if (await hasRustToolchain()) {
-  const { source, path } = generateRust(predicate, { out: 'policy.rs' })
-  const gate = await compileCheck({ crateDir: '.', predicate })
-  if (!gate.ok) console.error('compile gate failed:', gate.error)
-}
 ```
 
-The escape hatch is toolchain-gated: `hasRustToolchain()` returns `false`
-when `cargo` is not installed, and `compileCheck()` refuses to run on a
-machine without one. The generated source is **not** the on-chain interpreter
-— it is a deterministic off-chain reference that re-evaluates the same
-predicate for parity testing.
+Every function takes untrusted input, validates it through Zod schemas, and
+returns a machine-readable response envelope instead of throwing - the same
+contract whether the caller is a human script, the CLI, or an agent on the
+other side of MCP.
 
-## Composition rules
+Nothing in this package holds key material. Install and revoke return
+*unsigned* XDR; the wallet's signature is the confirmation step.
 
-The merged `policyRefs` on a `ProposedPolicy` are ordered
-`[interpreterRef?, ...oz_builtinRefs]` and bounded by
-`OZ_LIMITS.maxPoliciesPerRule` (5). The orchestrator refuses to install a
-policy that exceeds this cap (`POLICY_CAP_EXCEEDED`). The OZ-side `uncovered`
-warnings that the interpreter actually lowered (per-method scoping, recipient
-allowlists, exact ordered sequences, oracle price bounds, invocation-count
-windows, token-mismatch spending limits) are dropped from the user-facing
-warnings when the interpreter succeeds — the warning list reflects what is
-still UN-enforced, not what OZ alone could not do.
+## Security model
 
-## Status
+The synthesiser is the convenience layer; enforcement lives on chain in the
+policy interpreter, whose deployed addresses and wasm sha256 are pinned in
+`src/run/schemas.ts` and checked against the live network on install. The
+[architecture document](https://github.com/untangledfinance/octogate/blob/main/docs/architecture.md)
+is specific about what is and is not enforced; the audit status of the
+contracts is stated in the
+[repository README](https://github.com/untangledfinance/octogate#readme).
 
-Implemented and unit-test covered: the recorder, both synthesizer
-front-ends, the OZ Accounts adapter, the interpreter adapter, the
-predicate encoder, the evaluator, the deny-case battery, the minimiser, the
-self-verify pipeline, the simulate / verify surface, the review-card
-builder, the cross-check, and the Rust codegen escape hatch.
+## Related packages
 
-The on-chain Rust interpreter, install-transaction assembly, and live RPC
-integration are wired in the @crediolabs/policy-builder-cli layer (separate
-package).
+- [`@crediolabs/policy-builder-cli`](https://www.npmjs.com/package/@crediolabs/policy-builder-cli) - command-line record + synthesize.
+- [`@crediolabs/policy-builder-mcp`](https://www.npmjs.com/package/@crediolabs/policy-builder-mcp) - the same tools over MCP for agents.
 
 ## License
 
-MIT.
+MIT

package/dist/adapters/interpreter/adapter.d.ts

@@ -4,7 +4,7 @@ import type { Network, PredicateNode } from '../../types.ts';
 /** [VERIFY] NOT a real deployed address. The interpreter is a per-network
  *  deploy artifact we do not have yet; install is a later phase. */
 export declare const PLACEHOLDER_INTERPRETER_ADDRESS = "VERIFY-interpreter-address";
-/** Wasm-level oracle defaults (mirrors INTERPRETER_INSTALL_PARAMS.md OracleParams).
+/** Wasm-level oracle defaults (mirrors the interpreter's `OracleParams`).
  *  Per-policy overrides may TIGHTEN only - they may never exceed these. */
 export declare const ORACLE_DEFAULTS: {
     readonly maxStalenessSeconds: 600;
@@ -29,10 +29,9 @@ export interface InterpreterAdapterConfig {
 export declare function createInterpreterAdapter(config: InterpreterAdapterConfig): CustodyAdapter;
 /** Lower a single IR rule to the canonical pre-encoding `PredicateNode`. The
  *  orchestrator uses this to wire the self-verify + minimise pipeline: after
- *  `compile(ir)` succeeds (`covered === true`, `proposed` set), the
- *  orchestrator re-derives the PredicateNode via this helper to drive
- *  `minimize` and `runHarness` on the SAME shape the encoder saw. Pure and
- *  deterministic: same `rule + config` -> byte-identical PredicateNode. The
- *  `uncovered` list the adapter surfaces during compile is NOT re-derived
- *  here; callers that need it should use the result of `compile(ir)`. */
+ *  `compile(ir)` succeeds it re-derives the PredicateNode via this helper to
+ *  drive `minimize` and `runHarness` on the SAME shape the encoder saw. Pure
+ *  and deterministic: same `rule + config` -> byte-identical PredicateNode.
+ *  The `uncovered` list is NOT re-derived - callers needing it must use
+ *  `compile(ir)`. */
 export declare function lowerRuleToPredicate(rule: IRPolicyRule, config: InterpreterAdapterConfig): PredicateNode;

package/dist/adapters/interpreter/adapter.js

@@ -1,26 +1,9 @@
 // src/adapters/interpreter/adapter.ts - the interpreter-policy CustodyAdapter.
 //
 // Compiles a PolicyIR to a single interpreter `PolicyDocument` + `PolicyRef`
-// carrying the canonical predicate encoding defined in
-// `packages/policy-interpreter/INTERPRETER_INSTALL_PARAMS.md`. The adapter is
-// the second backend (the OZ built-in adapter is the first); together they
-// cover the canonical language subset. The compose step (P3) routes IR
-// constructs between them.
-//
-// What it lowers (every IR construct the predicate DSL expresses):
-//   - IRLogic and/or    -> PredicateNode and/or
-//   - IRLogic not       -> PredicateNode not
-//   - IRCompare         -> selector(left) vs literal(right), op carried over
-//   - IR `in`           -> needle=selector, haystack=literals (PURESET
-//                          membership; the haystack is always sorted by the
-//                          encoder)
-//   - IR `eq_seq`       -> eq(selectorLeaf, literal_vec([...])) - exact ordered
-//                          sequence equality; element order is preserved
-//                          verbatim (the encoder does NOT sort the vec)
-//   - IRSelector        -> matching PredicateLeaf (see lowerSelector)
-//   - scope.contract    -> sibling `call_contract == <contract>` (always
-//                          emitted when set)
-//   - scope.method      -> sibling `call_fn == <method>`
+// carrying the canonical predicate encoding from `predicate/encode.ts`. Second
+// backend (the OZ built-in adapter is the first); the compose step (P3) routes
+// IR constructs between them.
 //
 // Three fail-closed enforcement gates (per spec):
 //   - oracle_price leaves MUST sit directly under the top-level `and`; nesting
@@ -38,7 +21,7 @@ import { encodePredicate } from "../../predicate/encode.js";
 /** [VERIFY] NOT a real deployed address. The interpreter is a per-network
  *  deploy artifact we do not have yet; install is a later phase. */
 export const PLACEHOLDER_INTERPRETER_ADDRESS = 'VERIFY-interpreter-address';
-/** Wasm-level oracle defaults (mirrors INTERPRETER_INSTALL_PARAMS.md OracleParams).
+/** Wasm-level oracle defaults (mirrors the interpreter's `OracleParams`).
  *  Per-policy overrides may TIGHTEN only - they may never exceed these. */
 export const ORACLE_DEFAULTS = {
     maxStalenessSeconds: 600,
@@ -47,17 +30,15 @@ export const ORACLE_DEFAULTS = {
 const CAPABILITIES = {
     supportsSpendWindow: true,
     supportsThreshold: false, // thresholds are the OZ adapter's job
-    // False for the predicate-leaf path: the interpreter refuses a `valid_until`
-    // leaf at install. Expiry is still available, but as the context rule's
-    // validUntilLedger, which the smart account enforces - not as a predicate.
+    // Expiry is via the context rule's validUntilLedger, not a predicate - the
+    // interpreter refuses a `valid_until` leaf at install.
     supportsTimeExpiry: false,
     supportsOraclePrice: true,
     supportsInvocationCount: true,
     supportsGeneralPredicate: true,
 };
-/** Parse confidence for a deterministic (non-decoded) input: full, with an
- *  empty unknown/opaque breakdown. A mandate needs no decoding, so the gate is
- *  not applicable and confidence is 1. */
+/** Parse confidence for a deterministic (non-decoded) input: full (1.0). A
+ *  mandate needs no decoding, so the gate is not applicable. */
 const FULL_PARSE_CONFIDENCE = {
     overall: 1,
     knownContracts: [],
@@ -77,12 +58,11 @@ export function createInterpreterAdapter(config) {
 }
 /** Lower a single IR rule to the canonical pre-encoding `PredicateNode`. The
  *  orchestrator uses this to wire the self-verify + minimise pipeline: after
- *  `compile(ir)` succeeds (`covered === true`, `proposed` set), the
- *  orchestrator re-derives the PredicateNode via this helper to drive
- *  `minimize` and `runHarness` on the SAME shape the encoder saw. Pure and
- *  deterministic: same `rule + config` -> byte-identical PredicateNode. The
- *  `uncovered` list the adapter surfaces during compile is NOT re-derived
- *  here; callers that need it should use the result of `compile(ir)`. */
+ *  `compile(ir)` succeeds it re-derives the PredicateNode via this helper to
+ *  drive `minimize` and `runHarness` on the SAME shape the encoder saw. Pure
+ *  and deterministic: same `rule + config` -> byte-identical PredicateNode.
+ *  The `uncovered` list is NOT re-derived - callers needing it must use
+ *  `compile(ir)`. */
 export function lowerRuleToPredicate(rule, config) {
     return lowerRule(rule, config).predicate;
 }
@@ -132,9 +112,9 @@ function compile(ir, config) {
 function lowerRule(rule, config) {
     const uncovered = [];
     // scope -> context rule + sibling predicates. contract/method each become
-    // their own `eq` leaf and are merged into the top-level and alongside the
-    // constraints. This keeps the top-level shape `and` (mandatory per the oracle
-    // position rule and the canonical hash stability for `and`).
+    // their own `eq` leaf and are merged into the top-level `and` alongside the
+    // constraints. The top-level MUST be `and` so oracle leaves sit directly
+    // under it (mandatory per the oracle position rule + canonical hash stability).
     const scopeContract = rule.scope.contract;
     const scopeMethod = rule.scope.method;
     if (rule.scope.chainId !== undefined) {
@@ -242,18 +222,18 @@ function unsupportedConstruct(cond) {
                 return 'EVM calldata comparison (predicate DSL)';
             if (s.kind === 'value')
                 return 'tx.value comparison (predicate DSL)';
-            // The on-chain interpreter sees ONE authorized call - there is no
-            // `Context.sub_invocations` in v1 - so it cannot observe the
-            // transaction's token movements. `amount` has no value to read, and
-            // `window_spent` accumulates BY that amount, so its counter would never
-            // move. Deriving either from the call payload would quietly swap "value
+            // The on-chain interpreter sees ONE authorized call - no
+            // `Context.sub_invocations` in v1 - so it cannot observe token
+            // movements. `amount` has no value to read, and `window_spent`
+            // accumulates BY that amount, so its counter would never move.
+            // Deriving either from the call payload would quietly swap "value
             // actually moved" for "value the caller declared" - a weaker guarantee
             // than the review card would be claiming.
             //
-            // Rolling spend caps belong to the OZ `spending_limit` primitive, which
-            // is already audited and which the OZ adapter emits. A per-call cap is
-            // expressible here as `arg_field`; bounding it with `invocation_count`
-            // gives an enforceable ceiling per window.
+            // Rolling spend caps belong to the OZ `spending_limit` primitive (already
+            // audited, emitted by the OZ adapter). A per-call cap is expressible here
+            // as `arg_field`; bounding it with `invocation_count` gives an enforceable
+            // ceiling per window.
             return unsourceableSelector(s);
         }
         // Recurse: a nested `and`/`or`/`not` must not smuggle a selector past the
@@ -367,9 +347,9 @@ function lowerSelector(s) {
         case 'arg_field':
             return { kind: 'call_arg_field', index: s.argIndex, element: s.element, field: s.field };
         // `amount` / `window_spent` are filtered out by `unsupportedConstruct`
-        // before lowering - the interpreter cannot source either on chain. Reaching
-        // here means the pre-scan was bypassed, so fail loudly rather than emit a
-        // leaf the contract will refuse.
+        // before lowering - the interpreter cannot source either on chain.
+        // Reaching here means the pre-scan was bypassed; fail loudly rather than
+        // emit a leaf the contract will refuse.
         case 'amount':
         case 'window_spent':
             throw new Error(`interpreter adapter cannot lower \`${s.kind}\`: it should have been reported as uncovered`);

package/dist/adapters/oz/adapter.js

@@ -9,7 +9,7 @@
 // Anything needing a capability this backend lacks (oracle price, invocation
 // count, per-arg comparison/allowlist, guard, nested boolean predicate) is NOT
 // emitted: it is named in `uncovered` and `covered` is set false. Nothing is
-// silently dropped - the uncovered constructs are named instead.
+// silently dropped.
 //
 // OZ built-in policy instance addresses are per-network deploy artifacts we do
 // not have yet (install is a later phase). They are injected via config; week-1
@@ -27,9 +27,8 @@ export const PLACEHOLDER_OZ_INSTANCES = {
 export function placeholderOzConfig(network) {
     return { network, instances: PLACEHOLDER_OZ_INSTANCES };
 }
-/** Parse confidence for a deterministic (non-decoded) input: full, with an
- *  empty unknown/opaque breakdown. A mandate needs no decoding, so the gate is
- *  not applicable and confidence is 1. */
+/** Parse confidence for a deterministic (non-decoded) input: full (1.0). A
+ *  mandate needs no decoding, so the gate is not applicable. */
 const FULL_PARSE_CONFIDENCE = {
     overall: 1,
     knownContracts: [],
@@ -83,10 +82,10 @@ function compile(ir, config) {
 function lowerRule(rule, config) {
     const uncovered = [];
     const policyRefs = [];
-    // scope -> context rule type. OZ scopes by contract (CallContract); a finer
-    // method-level restriction is a predicate concern and must be flagged as not
-    // covered because CallContract alone permits other methods on the same contract
-    // (e.g. an unbounded approve alongside a capped transfer).
+    // scope -> context rule type. OZ scopes by contract (CallContract); a
+    // method-level restriction is flagged as not covered because CallContract
+    // alone permits other methods on the same contract (e.g. an unbounded approve
+    // alongside a capped transfer).
     const contextRuleType = rule.scope.contract !== undefined
         ? { kind: 'call_contract', contract: rule.scope.contract }
         : { kind: 'default' };
@@ -115,8 +114,8 @@ function lowerRule(rule, config) {
         uncovered.push(`guard: ${describeCondition(rule.guard)}`);
     }
     // constraints -> spending_limit where they match; else not covered. The OZ
-    // spending_limit policy takes `{ spending_limit: i128, period_ledgers: u32 }`
-    // and has NO token param: it only accepts a CallContract context rule
+    // spending_limit takes `{ spending_limit: i128, period_ledgers: u32 }` and
+    // has NO token param: it only accepts a CallContract context rule
     // (OnlyCallContractAllowed) and limits transfers of that context's contract,
     // so the spent token must equal the scope contract, and the window is a
     // ledger count (~5s/ledger), not seconds.
@@ -144,7 +143,7 @@ function lowerRule(rule, config) {
     }
     // approval.threshold -> simple/weighted threshold primitive. A threshold < 1
     // is not a real M-of-N gate (0 approvals authorises everything), so refuse to
-    // emit a no-op primitive and flag it as not covered instead.
+    // emit a no-op primitive and flag it as not covered.
     if (rule.approval) {
         if (!Number.isInteger(rule.approval.threshold) || rule.approval.threshold < 1) {
             uncovered.push(`approval threshold ${rule.approval.threshold} is not a positive integer (a 0 or negative threshold is not an M-of-N gate)`);
@@ -208,8 +207,8 @@ function matchSpendingLimit(c) {
 function describeCondition(cond) {
     switch (cond.op) {
         case 'slippage_floor':
-            // The OZ primitives bound a value against a constant; this bounds one
-            // call argument against another, which none of them can express.
+            // OZ primitives bound a value against a constant; this bounds one call
+            // argument against another, which none of them can express.
             return `slippage floor on arg[${cond.outArgIndex}] (OZ built-ins cannot bound one argument against another)`;
         case 'in':
             return `value allowlist on ${describeSelector(cond.selector)} (arg allowlist)`;

package/dist/codegen/compile-gate.js

@@ -75,6 +75,11 @@ publish = false
 
 [lib]
 crate-type = ["cdylib"]
+# The gate writes the source beside the manifest rather than under src/, so
+# the path is stated. Without it cargo looks for src/lib.rs and fails to
+# parse the manifest before it ever compiles anything, which reads as a
+# broken generator rather than a broken scaffold.
+path = "lib.rs"
 
 [dependencies]
 soroban-sdk = "22"

package/dist/codegen/template.js

@@ -1,6 +1,23 @@
 // src/codegen/template.ts - deterministic Rust source generator for the OZ
 // `Policy` escape-hatch skeleton.
 //
+// SUPERSEDED. The architecture this belongs to no longer exists. A deployed
+// policy involves exactly two contracts, the OZ smart account and one
+// immutable interpreter, and the synthesiser emits policy DATA rather than
+// code. Nothing on the synthesis path reaches this module, and no install can
+// produce a contract from it. When a constraint falls outside the grammar the
+// answer is to version the synthesiser and the interpreter together, not to
+// put unaudited Rust on chain per policy.
+//
+// Deleting it is a decision nobody has taken yet, not a dependency question.
+// `compile-gate.ts` takes a Rust string and knows nothing about this module,
+// and its tests compile a hardcoded fixture, so the gate keeps working either
+// way. What deleting this would remove is the only in-repo producer of policy
+// Rust for the gate to check. Do not read its presence as the product
+// generating contracts, and do not wire it into the synthesis path.
+//
+// What follows describes the abandoned design.
+//
 // This is the LAST-RESORT tool for constraints the v1 DSL cannot express. It
 // lives OUT of the audited happy-path surface; the synthesiser never emits it
 // automatically. It mirrors Zodiac Roles' `Custom` operator: a hand-written