@crediolabs/policy-synth 0.1.17 → 0.2.0

package/src/run/schemas.ts

@@ -7,9 +7,9 @@
 // step with the TS source of truth.
 //
 // i128 amounts and other large integers are carried as base-10 decimal strings
-// end-to-end (no JS number coercion). Networks are pinned to the same closed
-// set the core defines. The discriminated union on `source` exposes BOTH
-// synthesize_policy front-ends through a single tool input.
+// end-to-end. Networks are pinned to the same closed set the core defines.
+// The discriminated union on `source` exposes BOTH synthesize_policy
+// front-ends through a single tool input.
 //
 // This module is the SINGLE source of truth for these shapes. The MCP package
 // imports them here so its tool-shape bindings stay in step; the CLI imports
@@ -139,6 +139,25 @@ export const MandateSpecSchema = z
       .optional(),
   })
   .passthrough()
+  // TS-F4/F6: a `recipients` allowlist is only meaningful against a SEP-41
+  // method whose arg 1 IS the recipient (SAC/SEP-41 `transfer(from, to,
+  // amount)` and SEP-41 `mint(to, amount)`). Without this gate the
+  // `to-ir.ts` lowering pins the allowlist to `RECIPIENT_ARG_INDEX = 1`
+  // for any contract+method, which would let a non-SEP-41 method's
+  // arg[1] (e.g. an amount, an op type, an arbitrary address payload)
+  // be silently constrained as if it were a recipient. Refusing
+  // non-SEP-41 methods at the boundary is the fail-closed shape.
+  .refine(
+    (v) =>
+      v.recipients === undefined ||
+      v.recipients.length === 0 ||
+      v.method === 'transfer' ||
+      v.method === 'mint',
+    {
+      message:
+        'recipients is only valid when method is a SEP-41 method (transfer or mint); other methods do not have a recipient at arg[1]',
+    }
+  )
 
 /** ComposeUserResponses mirrors the core. */
 export const ComposeUserResponsesSchema = z
@@ -157,6 +176,23 @@ export const ComposeUserResponsesSchema = z
     swapRecipientAllowlist: z
       .array(z.string().refine(isStellarAddress, 'must be a Stellar address (G... or C...)'))
       .optional(),
+    // Per-asset oracle-price bound, one entry per asset. Reaches
+    // `compose-from-recording` and emits an `oracle_price` compare. Declared
+    // here because the object is `.passthrough()`: the field already worked
+    // undeclared, which left the accepted surface wider than the documented
+    // one. `decimals` is REQUIRED - oracle prices normalise to 9 dp and a
+    // threshold silently assumed to share that basis is what let a raw 14-dp
+    // bound permit everything.
+    oraclePriceBound: z
+      .array(
+        z.object({
+          asset: z.string().refine(isStellarAddress, 'must be a Stellar address (G... or C...)'),
+          operator: z.enum(['eq', 'lt', 'lte', 'gt', 'gte']),
+          value: z.string().regex(/^[0-9]+$/),
+          decimals: z.number().int().min(0).max(U32_MAX),
+        })
+      )
+      .optional(),
   })
   .passthrough()
 
@@ -293,7 +329,12 @@ export const PredicateLeafSchema: z.ZodType<unknown> = z.lazy(() =>
       windowSeconds: z.number().int().positive(),
     }),
     z.object({ kind: z.literal('now') }),
-    z.object({ kind: z.literal('valid_until') }),
+    // `valid_until` is NOT in the public predicate grammar: the encoder +
+    // decoder already throw on it, so accepting it here would let a
+    // hand-crafted payload through the schema and only surface a 200+
+    // character internal-commentary error at encode time. Drop it - the
+    // policy's expiry is carried at the install layer (MandateSpec +
+    // validUntilLedger) instead.
     z.object({
       kind: z.literal('invocation_count_in_window'),
       windowSecs: z.number().int().positive(),
@@ -475,26 +516,36 @@ const MandateSpecSchemaForRule = z
 // reference resolves at module init. They are the new tools on top of the
 // existing four.
 
-/** Pinned interpreter address (testnet). Mirrors DEPLOYMENTS.md:128.
+/** Pinned interpreter address (testnet).
  *  Single source for the MCP layer; do not embed elsewhere. */
 export const PINNED_INTERPRETER_TESTNET_ADDRESS =
-  'CDR4NLV22STCXFGZPNKDQTEANWLF7LZ6AJLY6B7CLJXKHDZGYJWIOKGP'
-
-/** Pinned interpreter address (mainnet). Mirrors DEPLOYMENTS.md:18. Mainnet
- *  has now been deployed (2026-08-04); the mainnet interpreter IS the binary
- *  that was exercised on testnet (same wasm sha256, see
- *  PINNED_INTERPRETER_WASM_SHA256). The address differs because instance
- *  ids are network-scoped. UNAUDITED at the time of writing - see
- *  DEPLOYMENTS.md:29-32 for the recorded decision and what is still pending. */
+  'CALHNU4LXZRKFAXYRBODTGDANTNXHJPBTJNYGLUWLIFIP24NWSGWIE4K'
+
+/** Pinned interpreter address (mainnet), deployed 2026-08-04.
+ *  UNAUDITED at the time of writing. */
 export const PINNED_INTERPRETER_MAINNET_ADDRESS =
   'CALZAMUPREIRY4TULBEXIK77AUTOEJG63XLCPUWEHHQDOVK6ZVVS7VQ2'
 
-/** Pinned interpreter wasm sha256 (hex). Mirrors DEPLOYMENTS.md:156-157. */
+/** Pinned interpreter wasm sha256 (hex), mainnet.
+ *
+ *  The two networks no longer run the same binary. Testnet carries the
+ *  selector-leaf minimum and the signer-set cap; mainnet predates both. Read
+ *  the hash through `PINNED_INTERPRETER_WASM_SHA256_BY_NETWORK` rather than
+ *  this constant unless mainnet is specifically what is meant, or
+ *  `get_interpreter_info` will report a hash the queried network does not
+ *  run. */
 export const PINNED_INTERPRETER_WASM_SHA256 =
   '6e6c13d93e197aa380303a42cd120f5ddb080dd36ef2a343ee1dbd04ca52a443'
 
+/** Pinned interpreter wasm sha256 (hex), testnet. Byte-identical to the
+ *  artifact built from `contracts/policy-interpreter` at the commit that
+ *  introduced errors 216 and 217, verified by fetching the deployed wasm back
+ *  off chain. */
+export const PINNED_INTERPRETER_WASM_SHA256_TESTNET =
+  'a4d58bc88fd82bbb8e223941ba5889db919717fae92ced13f6f55bfe583b8e22'
+
 /** The grammar version the interpreter enforces (matches SELF_VERSION in
- *  packages/policy-interpreter/src/version.rs). */
+ *  contracts/policy-interpreter/src/version.rs). */
 export const PINNED_INTERPRETER_GRAMMAR_VERSION = 1
 
 /** Default Soroban RPC for the install / revoke / info tools. The recorder
@@ -509,14 +560,18 @@ export const TESTNET_RPC_URL = 'https://soroban-testnet.stellar.org'
  *  the deploy script hit during the 2026-08-04 mainnet rollout. */
 export const MAINNET_RPC_URL = 'https://mainnet.sorobanrpc.com'
 
-/** Pin + RPC lookup for the gate enforcement. The interpreters' wasm sha256
- *  is identical across both networks (the same binary was uploaded both
- *  places; DEPLOYMENTS.md:25-27), so `PINNED_INTERPRETER_WASM_SHA256` stays
- *  a single constant - only the addresses and RPCs are network-scoped. */
+/** Pin + RPC lookup for the gate enforcement. Addresses, RPCs and wasm
+ *  hashes are all network-scoped: the networks diverged when the
+ *  selector-leaf and signer-cap controls were deployed to testnet ahead of
+ *  mainnet. */
 export const PINNED_INTERPRETER_ADDRESS_BY_NETWORK: Record<Network, string> = {
   testnet: PINNED_INTERPRETER_TESTNET_ADDRESS,
   mainnet: PINNED_INTERPRETER_MAINNET_ADDRESS,
 }
+export const PINNED_INTERPRETER_WASM_SHA256_BY_NETWORK: Record<Network, string> = {
+  testnet: PINNED_INTERPRETER_WASM_SHA256_TESTNET,
+  mainnet: PINNED_INTERPRETER_WASM_SHA256,
+}
 export const RPC_URL_BY_NETWORK: Record<Network, string> = {
   testnet: TESTNET_RPC_URL,
   mainnet: MAINNET_RPC_URL,
@@ -534,13 +589,27 @@ export const NETWORK_PASSPHRASES: Record<Network, string> = {
   mainnet: 'Public Global Stellar Network ; September 2015',
 }
 
+// Stellar strkey shapes (StrKey base32, no checksum byte, version byte
+// 0x30/0x40 prefixed by the decoder, then 32 base32 chars giving a 56-char
+// total). The shared `isStellarAddress` helper accepts BOTH wallet (G...) and
+// contract (C...) addresses; the install schema has to distinguish them
+// because the smart account is a contract (C...) - a wallet address would
+// mean the rule is being installed against the WRONG account kind entirely.
+// `sourceAccount` is the signing wallet (G...).
+const STELLAR_CONTRACT_ADDRESS = /^C[2-7A-Z]{55}$/
+const STELLAR_ACCOUNT_ADDRESS = /^G[2-7A-Z]{55}$/
+
 export const InstallPolicyInputSchema = z
   .object({
     /** The smart account contract address (C...) that will receive the rule. */
-    smartAccount: z.string(),
+    smartAccount: z
+      .string()
+      .regex(STELLAR_CONTRACT_ADDRESS, 'smartAccount must be a Stellar contract address (C...)'),
     /** The signer that authorises the install (G... wallet). Used only for
      *  sequence number + auth nonce simulation; never persisted, never signed. */
-    sourceAccount: z.string(),
+    sourceAccount: z
+      .string()
+      .regex(STELLAR_ACCOUNT_ADDRESS, 'sourceAccount must be a Stellar account address (G...)'),
     /** Target network for the install. Selects which interpreter pin and
      *  which RPC URL are valid by default. Defaults to `testnet` so the
      *  pre-mainnet callers keep working: they were always pointing at
@@ -570,6 +639,17 @@ export const InstallPolicyInputSchema = z
      *  everything. Selecting `network: 'mainnet'` is NOT an opt-in -
      *  the mainnet pin is its own deny-by-default anchor. */
     allowUnpinnedInterpreter: z.boolean().optional(),
+    /** Opt-in to installing when a signer of this rule can already reach the
+     *  same calls through a context rule that has NO policy attached. OZ lets
+     *  the signer choose which rule authorises a call and enforces only that
+     *  rule's policies, so an unpoliced rule covering the same calls makes
+     *  this policy decorative. Default-deny, because the caller almost
+     *  certainly believes they are restricting something. */
+    allowAuthorityOverlap: z.boolean().optional(),
+    /** Skip the cross-rule authority scan entirely. The scan costs one RPC
+     *  read per rule on the account; skipping it means the response carries
+     *  no statement about what the signers can already do. */
+    skipAuthorityScan: z.boolean().optional(),
     /** Base fee in stroops; defaults to BASE_FEE (100). */
     baseFee: z.number().int().positive().optional(),
   })
@@ -578,15 +658,49 @@ export const InstallPolicyInputSchema = z
   })
 export type InstallPolicyInput = z.infer<typeof InstallPolicyInputSchema>
 
+/** `merge_policy` input.
+ *
+ *  The tightening remedy for a cross-rule overlap: replace a rule's predicate
+ *  with the conjunction of it and a new one. Two transactions, in order,
+ *  because OZ refuses to re-attach a policy already on the rule - so the
+ *  caller runs `detach`, waits for it to confirm, then runs `reinstall`. */
+export const MergePolicyInputSchema = z
+  .object({
+    smartAccount: z
+      .string()
+      .regex(STELLAR_CONTRACT_ADDRESS, 'smartAccount must be a Stellar contract address (C...)'),
+    sourceAccount: z
+      .string()
+      .regex(STELLAR_ACCOUNT_ADDRESS, 'sourceAccount must be a Stellar account address (G...)'),
+    /** The rule whose predicate is being tightened. */
+    ruleId: z.number().int().nonnegative(),
+    /** The predicate to conjoin, base64 canonical ScVal, as emitted by
+     *  `synthesize_policy`. */
+    incomingPredicateBlobBase64: z.string().min(1),
+    /** Which half of the remedy to build. */
+    step: z.enum(['detach', 'reinstall']),
+    network: NetworkSchema.optional(),
+    rpcUrl: z.string().url().optional(),
+    allowUnpinnedRpcUrl: z.boolean().optional(),
+    baseFee: z.number().int().positive().optional(),
+  })
+  .strict()
+
+export type MergePolicyInput = z.infer<typeof MergePolicyInputSchema>
+
 export const RevokePolicyInputSchema = z
   .object({
     /** The smart account contract address (C...). */
-    smartAccount: z.string(),
+    smartAccount: z
+      .string()
+      .regex(STELLAR_CONTRACT_ADDRESS, 'smartAccount must be a Stellar contract address (C...)'),
     /** The wallet that will sign the removal. The ACCOUNT decides whether it
      *  accepts that signer; this schema does not assert a rule it cannot
      *  verify, since the account's source is not in this repo. Proven on
      *  testnet: the account's deployer can revoke. */
-    sourceAccount: z.string(),
+    sourceAccount: z
+      .string()
+      .regex(STELLAR_ACCOUNT_ADDRESS, 'sourceAccount must be a Stellar account address (G...)'),
     /** Target network for the revoke. Same `testnet`-default as install,
      *  so pre-mainnet callers keep working without an explicit flag. */
     network: NetworkSchema.optional(),
@@ -610,8 +724,15 @@ export const GetInterpreterInfoInputSchema = z.object({
   /** When true, perform an optional live `grammar_version()` RPC call to
    *  verify the deployed contract matches the pin. */
   verifyLive: z.boolean().optional(),
-  /** Optional RPC URL override. */
+  /** Optional RPC URL override. When `verifyLive` is true, the URL must
+   *  equal the pinned RPC for the selected network unless
+   *  `allowUnpinnedRpcUrl: true` is also set (same opt-in shape as
+   *  install/revoke - the live grammar_version() answer binds to whichever
+   *  RPC returned it). */
   rpcUrl: z.string().url().optional(),
+  /** Opt-in to using a non-pinned RPC URL when `verifyLive` is true. Same
+   *  semantics as install/revoke: the caller accepts the trust shift. */
+  allowUnpinnedRpcUrl: z.boolean().optional(),
 })
 export type GetInterpreterInfoInput = z.infer<typeof GetInterpreterInfoInputSchema>
 

package/src/synth/compose-from-recording.ts

@@ -1,52 +1,42 @@
-// src/synth/compose-from-recording.ts - facts + scope -> PolicyIR (OZ-shape + interpreter-shape).
-//
-// Composes the canonical IR rules the two backends compile FROM. Fail-closed
-// composition rules:
-//
-//   - identify the protocol of the top-level call (registry.identifyProtocol).
-//     When it is unknown (null), emit NO OZ-primitive-producing IR node: the
-//     scope is kept (CallContract + method) and every inferred bound is surfaced
-//     as a descriptive warning. An unrecognised call never compiles to a
-//     permissive OZ primitive.
+// src/synth/compose-from-recording.ts - facts + scope -> PolicyIR (OZ + interpreter).
 //
+// Fail-closed composition rules:
+//   - unknown top-level protocol (registry.identifyProtocol returns null) ->
+//     emit no OZ-primitive-producing IR node; scope is kept (CallContract + method)
+//     and every inferred bound surfaces as a descriptive warning. An unrecognised
+//     call never compiles to a permissive OZ primitive.
 //   - carry the recorded top-level function into `rule.scope.method` so the OZ
 //     adapter flags per-method scoping as not covered (CallContract permits every
-//     method on the contract; a per-method restriction needs the interpreter predicate).
-//
-//   - a `spending_limit` (window_spent(token, w) <= limit) is emitted ONLY when
-//     the caller supplies BOTH the limit (userResponses.limitAmount) and the
-//     window (userResponses.windowSeconds). A single recorded spend does NOT
-//     authorise that amount every window, so the observed amount is NEVER used as
-//     an auto-ceiling: a missing limit surfaces AMOUNT_BOUND_MISSING (the observed
-//     amount is offered as a suggestion), a missing window surfaces
-//     DURATION_UNSPECIFIED. EVERY spent token is handled - none is silently
-//     dropped; a single caller limit binds only an unambiguous single-token spend.
-//
-//   - incoming-only flows (e.g. Blend yield claim) emit an `invocation_count`
-//     bound ONLY when the caller supplies the count (userResponses.invocationLimit)
-//     and a window; otherwise FREQUENCY_BOUND_MISSING is surfaced with no
-//     fabricated count.
-//
-//   - the IR carries ONLY constraints justified by the recording (observed
-//     recipient allowlist) + explicit user input. Nothing invented: no oracle
-//     price fabricated from a slippage bound, no synthetic exact-path compare.
-//     Those needs are surfaced as descriptive warnings instead.
+//     method; a per-method restriction needs the interpreter predicate).
+//   - `spending_limit` (window_spent(token, w) <= limit) is emitted ONLY when
+//     the caller supplies BOTH limit (userResponses.limitAmount) AND window
+//     (userResponses.windowSeconds). A single recorded spend does NOT authorise
+//     that amount every window, so the observed amount is NEVER used as an
+//     auto-ceiling: missing limit -> AMOUNT_BOUND_MISSING (observed amount
+//     offered as a suggestion); missing window -> DURATION_UNSPECIFIED. EVERY
+//     spent token is handled - none is silently dropped.
+//   - incoming-only flows emit an `invocation_count` bound ONLY when the caller
+//     supplies both the count and the window; otherwise FREQUENCY_BOUND_MISSING
+//     with no fabricated count.
+//   - the IR carries ONLY constraints justified by the recording + explicit
+//     user input. Nothing invented: no oracle price fabricated from a slippage
+//     bound, no synthetic exact-path compare. Those needs surface as warnings.
 //
 // Split rule (P3 wiring): `ComposeResult` carries BOTH `ir` (OZ-shape) and
 // `interpreterIr` (predicate-shape). Each constraint is routed to EXACTLY ONE
 // adapter:
-//   - `compare window_spent(token, w) <= limit` where `token === scope.contract`
-//     and the protocol is known -> `ir` (OZ lowers to spending_limit).
-//   - everything else the compose step emits (recipient allowlists, per-method
-//     scoping via scope.method, invocation_count bounds, eq_seq swap paths,
-//     oracle_price bounds, AND window_spent where token != scope.contract, i.e.
-//     a SoroSwap input-token cap) -> `interpreterIr`.
+//   - `window_spent(token, w) <= limit` where `token === scope.contract` and
+//     protocol is known -> `ir` (OZ lowers to spending_limit).
+//   - everything else (recipient allowlists, per-method scope.method,
+//     invocation_count, eq_seq swap paths, oracle_price, AND window_spent
+//     where token != scope.contract i.e. SoroSwap input-token cap) ->
+//     `interpreterIr`.
 //
 // This prevents the interpreter adapter from emitting a duplicate
 // `window_spent` predicate leaf alongside an OZ `spending_limit` primitive
 // covering the same spend semantic - the two adapters never overlap.
 //
-// The default behavior is `deny_all` (OZ context rules are deny-by-default).
+// Default policy is `deny_all` (OZ context rules are deny-by-default).
 
 import type { IRCompOp, IRCondition, IRPolicyRule, PolicyIR } from '../ir/types.ts'
 import { type IdentifiedProtocol, identifyProtocol } from '../registry/identify.ts'
@@ -81,25 +71,20 @@ export interface ComposeUserResponses {
    *  invocation_count bound; absent -> FREQUENCY_BOUND_MISSING. */
   invocationLimit?: number
   /** Per-asset oracle-price bound(s). Each entry lowers to a single
-   *  `oracle_price(asset) OP value` compare in the interpreter IR. Multiple
-   *  entries on the same asset emit multiple leaves. */
+   *  `oracle_price(asset) OP value` compare in the interpreter IR. */
   oraclePriceBound?: OraclePriceBound[]
   /** Minimum acceptable swap output per unit of input, as `num/den` (e.g.
-   *  `{num:'95',den:'100'}` = accept losing at most 5%). Emitted as a
-   *  slippage floor bounding the output arg against the input arg of the same
-   *  call.
-   *
-   *  REQUIRED to be supplied by the caller: it is never derived from the
-   *  recording. The recorded in/out pair is a price at one moment, and
-   *  freezing it as policy would deny ordinary trades as soon as the rate
-   *  moves. Absent, no floor is emitted and the existing unbounded-output
-   *  warning stands. */
+   *  `{num:'95',den:'100'}` = accept losing at most 5%). REQUIRED to be
+   *  supplied by the caller: never derived from the recording (the recorded
+   *  in/out pair is a price at one moment, and freezing it as policy would
+   *  deny ordinary trades as soon as the rate moves). Absent, no floor is
+   *  emitted and the existing unbounded-output warning stands. */
   swapMinOutRatio?: { num: string; den: string }
   /** Recipient allowlist for a swap (call_arg[3] on SoroSwap's
-   *  swap_exact_tokens_for_tokens). When supplied, it REPLACES the default
-   *  pin. Absent -> the recipient is pinned to the recorded value (mirroring
-   *  SEP-41) and RECIPIENT_ALLOWLIST_EMPTY is surfaced as informational, never
-   *  a silent free pass. */
+   *  swap_exact_tokens_for_tokens). When supplied, REPLACES the default pin.
+   *  Absent -> recipient is pinned to the recorded value (mirroring SEP-41)
+   *  and RECIPIENT_ALLOWLIST_EMPTY surfaces as informational, never a silent
+   *  free pass. */
   swapRecipientAllowlist?: string[]
 }
 
@@ -144,6 +129,13 @@ export function composeFromRecording(
   const warnings: string[] = []
   const ozConstraints: IRCondition[] = []
   const interpreterConstraints: IRCondition[] = []
+  // Route to the matching IR. When the interpreter is enabled, constraints the
+  // OZ adapter cannot lower go there; otherwise they go to OZ (which flags them
+  // as uncovered) so today's warning-driven behaviour is preserved.
+  const routeToAdapter = (cond: IRCondition): void => {
+    if (interpreterEnabled) interpreterConstraints.push(cond)
+    else ozConstraints.push(cond)
+  }
 
   const protocol = topLevel
     ? identifyProtocol(topLevel.contract, topLevel.fn, topLevel.args, opts.network)
@@ -154,14 +146,15 @@ export function composeFromRecording(
   const limitAmount = opts.userResponses?.limitAmount
   const spendTokens = Object.keys(facts.spendByToken)
 
-  // Outgoing spend -> one spending_limit per spent token. A single caller limit
-  // binds only an unambiguous single-token spend; a multi-token flow needs a
-  // per-token limit, so each unmatched token surfaces AMOUNT_BOUND_MISSING.
+  // Outgoing spend -> one spending_limit per spent token. A single caller
+  // limit binds only an unambiguous single-token spend; a multi-token flow
+  // needs a per-token limit, so each unmatched token surfaces
+  // AMOUNT_BOUND_MISSING.
   //
   // Routing: a `window_spent(token, w) <= limit` constraint goes to the OZ IR
   // only when token === scope.contract (OZ's spending_limit binds the
   // CallContract target, not a token parameter). Otherwise it goes to the
-  // interpreter IR (the interpreter lowers window_spent to a predicate leaf).
+  // interpreter IR.
   if (spendTokens.length > 0 && topLevel) {
     let durationFlagged = false
     for (const token of spendTokens) {
@@ -190,24 +183,23 @@ export function composeFromRecording(
         })
         continue
       }
-      if (windowSeconds !== undefined && limit !== undefined) {
-        const spendCond: IRCondition = {
+      if (windowSeconds !== undefined) {
+        // Rolling spend cap always goes to OZ (`spending_limit` is the audited
+        // implementation). The interpreter is NOT a fallback for token !=
+        // scopeContract: on chain it sees one authorized call, not the
+        // transaction's token movements, so it has no per-call amount to
+        // accumulate and the counter would never move. OZ reports the case it
+        // cannot cover (limit pins to the context contract) - the honest
+        // outcome; the old fallback produced an interpreter predicate that
+        // silently never bound.
+        ozConstraints.push({
           op: 'compare',
           compare: {
             selector: { kind: 'window_spent', token, windowSeconds },
             operator: 'lte',
             value: limit,
           },
-        }
-        // A rolling spend cap always goes to OZ, whose `spending_limit` is the
-        // audited implementation. The interpreter is NOT a fallback for the
-        // token != scopeContract case: on chain it sees one authorized call,
-        // not the transaction's token movements, so it has no per-call amount
-        // to accumulate and the counter would never move. OZ reports the case
-        // it cannot cover (it pins the limit to the context contract), which
-        // is the honest outcome - the old fallback produced an interpreter
-        // predicate that silently never bound.
-        ozConstraints.push(spendCond)
+        })
         if (interpreterEnabled && token !== scopeContract) {
           warnings.push(
             `rolling spend cap on ${token} cannot be enforced on chain: OZ spending_limit pins the limit to the context contract, and the interpreter cannot observe token movements. Bound the per-call value with an argument cap plus an invocation-count limit instead.`
@@ -222,18 +214,18 @@ export function composeFromRecording(
   // Routed to the interpreter IR when interpreter is enabled (OZ cannot lower
   // invocation_count); otherwise to the OZ IR (which flags it as uncovered).
   //
-  // A recognised swap is NOT an incoming-only flow: it has an outgoing input leg
-  // whose spend simply was not attributed to the source account (the
-  // fee-sponsored / holder != source case). Its real restrictions - exact path,
-  // recipient, and the input-amount cap - come from the protocol-specific pass,
-  // so it does NOT get the incoming-only frequency prompt. A caller who wants to
+  // A recognised swap is NOT an incoming-only flow: it has an outgoing input
+  // leg whose spend simply was not attributed to the source account
+  // (fee-sponsored / holder != source). Its real restrictions - exact path,
+  // recipient, input-amount cap - come from the protocol-specific pass, so it
+  // does NOT get the incoming-only frequency prompt. A caller wanting to
   // rate-limit the swap can still supply an invocationLimit + window, which
   // lowers to an invocation_count for any flow.
   if (spendTokens.length === 0 && topLevel) {
     const invocationLimit = opts.userResponses?.invocationLimit
     const isRecognisedSwap = protocol?.protocol === 'soroswap'
     if (known && windowSeconds !== undefined && invocationLimit !== undefined) {
-      const icCond: IRCondition = {
+      routeToAdapter({
         op: 'compare',
         compare: {
           selector: { kind: 'invocation_count', windowSeconds },
@@ -243,12 +235,7 @@ export function composeFromRecording(
           operator: 'lt',
           value: String(invocationLimit),
         },
-      }
-      if (interpreterEnabled) {
-        interpreterConstraints.push(icCond)
-      } else {
-        ozConstraints.push(icCond)
-      }
+      })
     } else if (!isRecognisedSwap) {
       ambiguities.push({
         code: 'FREQUENCY_BOUND_MISSING',
@@ -266,7 +253,7 @@ export function composeFromRecording(
   const oracleBounds = opts.userResponses?.oraclePriceBound
   if (oracleBounds) {
     for (const b of oracleBounds) {
-      const oracleCond: IRCondition = {
+      routeToAdapter({
         op: 'compare',
         compare: {
           selector: { kind: 'oracle_price', asset: b.asset },
@@ -274,12 +261,7 @@ export function composeFromRecording(
           value: b.value,
           valueDecimals: b.decimals,
         },
-      }
-      if (interpreterEnabled) {
-        interpreterConstraints.push(oracleCond)
-      } else {
-        ozConstraints.push(oracleCond)
-      }
+      })
     }
   }
 
@@ -296,8 +278,8 @@ export function composeFromRecording(
     // arg cap is skipped to avoid binding one limit to two different semantics.
     const swapInputAmountCap = spendTokens.length === 0 ? limitAmount : undefined
     appendProtocolSpecificConstraints(
-      ozConstraints,
       interpreterConstraints,
+      routeToAdapter,
       warnings,
       ambiguities,
       facts,
@@ -353,8 +335,8 @@ export function composeFromRecording(
  *  (oraclePriceBound + limitAmount) + the recorded path (eq_seq on
  *  call_arg[2]). */
 function appendProtocolSpecificConstraints(
-  ozConstraints: IRCondition[],
   interpreterConstraints: IRCondition[],
+  routeToAdapter: (cond: IRCondition) => void,
   warnings: string[],
   ambiguities: AmbiguityPrompt[],
   facts: IntentFacts,
@@ -365,31 +347,24 @@ function appendProtocolSpecificConstraints(
   swapMinOutRatio: { num: string; den: string } | undefined,
   interpreterEnabled: boolean
 ): void {
-  // SEP-41 transfer / mint: the `to` arg (index 1) is the recipient. Emit it as
-  // a single-element allowlist; the interpreter adapter lowers it to `in`.
+  // SEP-41 transfer / mint: the `to` arg (index 1) is the recipient. Emit a
+  // single-element allowlist; the interpreter adapter lowers it to `in`.
   // When interpreter is not enabled, route to OZ so the caller sees today's
-  // `value allowlist on arg 1 (arg allowlist)` warning.
+  // `value allowlist on arg 1` warning.
   if (protocol.protocol === 'sep41' && (protocol.fn === 'transfer' || protocol.fn === 'mint')) {
     const toArg = topLevel.args[1]
     if (toArg && toArg.type === 'address') {
-      const cond: IRCondition = {
+      routeToAdapter({
         op: 'in',
         selector: { kind: 'arg', argIndex: 1, scalarType: 'address' },
         values: [toArg.value],
-      }
-      if (interpreterEnabled) {
-        interpreterConstraints.push(cond)
-      } else {
-        ozConstraints.push(cond)
-      }
+      })
     }
   }
 
   // Blend submit / claim: the `to` arg is the beneficiary - it receives the
   // resulting position shares on `submit` and the claimed tokens on `claim`.
-  // That is the same role as the SEP-41 recipient above and the SoroSwap swap
-  // recipient below, so it is pinned to the recorded address the same way:
-  // without it a policy scoped to a pool and method still lets an agent send
+  // Without it, a policy scoped to a pool + method still lets an agent send
   // the proceeds anywhere. `from` and `spender` are deliberately NOT pinned -
   // the call already requires their authorisation, so binding them adds no
   // restriction the chain is not already enforcing.
@@ -398,25 +373,20 @@ function appendProtocolSpecificConstraints(
     // claim(from, reserve_token_ids, to).
     const toArg = topLevel.args[2]
     if (toArg && toArg.type === 'address') {
-      const cond: IRCondition = {
+      routeToAdapter({
         op: 'in',
         selector: { kind: 'arg', argIndex: 2, scalarType: 'address' },
         values: [toArg.value],
-      }
-      if (interpreterEnabled) {
-        interpreterConstraints.push(cond)
-      } else {
-        ozConstraints.push(cond)
-      }
+      })
     }
   }
 
   // Blend `submit` ONLY (not `claim`, whose vec arg is a vec<u32> of
   // reserve_token_ids - no map fields to bind). The `requests` vec
   // (call_arg[3]) is a vec<Request{ address, amount, request_type }>. Each
-  // Request is the per-reserve action selector - 0 Supply, 1 Withdraw,
+  // Request is the per-reserve action selector (0 Supply, 1 Withdraw,
   // 2 SupplyCollateral, 3 WithdrawCollateral, 4 Borrow, 5 Repay, 6-9
-  // liquidation/auction fills. Pinning only one element is unsafe: a caller
+  // liquidation/auction fills). Pinning only one element is unsafe: a caller
   // can append a second element with a different action (WithdrawCollateral
   // -> Borrow on a different asset, any amount, then auction fills). Length
   // + per-element pinning is total; a quantifier over elements is not. If we
@@ -565,19 +535,14 @@ function appendProtocolSpecificConstraints(
       inputAmountArg &&
       inputAmountArg.type === 'i128'
     ) {
-      const cond: IRCondition = {
+      routeToAdapter({
         op: 'compare',
         compare: {
           selector: { kind: 'arg', argIndex: inputArgIndex, scalarType: 'i128' },
           operator: 'lte',
           value: swapInputAmountCap,
         },
-      }
-      if (interpreterEnabled) {
-        interpreterConstraints.push(cond)
-      } else {
-        ozConstraints.push(cond)
-      }
+      })
     }
 
     // Slippage floor: `out >= in * num/den`. Only when the caller supplied the
@@ -592,18 +557,13 @@ function appendProtocolSpecificConstraints(
       inputAmountArg &&
       inputAmountArg.type === 'i128'
     ) {
-      const floor: IRCondition = {
+      routeToAdapter({
         op: 'slippage_floor',
         outArgIndex: outMinArgIndex,
         inArgIndex: inputArgIndex,
         num: minOutRatio.num,
         den: minOutRatio.den,
-      }
-      if (interpreterEnabled) {
-        interpreterConstraints.push(floor)
-      } else {
-        ozConstraints.push(floor)
-      }
+      })
     }
 
     // Swap recipient (call_arg[3]): when the caller supplies
@@ -620,16 +580,11 @@ function appendProtocolSpecificConstraints(
     // (today's behaviour, matching the other SoroSwap constraints).
     const recipientArg = topLevel.args[3]
     if (swapRecipientAllowlist && swapRecipientAllowlist.length > 0) {
-      const cond: IRCondition = {
+      routeToAdapter({
         op: 'in',
         selector: { kind: 'arg', argIndex: 3, scalarType: 'address' },
         values: [...swapRecipientAllowlist],
-      }
-      if (interpreterEnabled) {
-        interpreterConstraints.push(cond)
-      } else {
-        ozConstraints.push(cond)
-      }
+      })
     } else if (interpreterEnabled && recipientArg && recipientArg.type === 'address') {
       interpreterConstraints.push({
         op: 'in',