@crediolabs/policy-synth 0.1.17 → 0.2.0

package/dist/run/schemas.js

@@ -7,9 +7,9 @@
 // step with the TS source of truth.
 //
 // i128 amounts and other large integers are carried as base-10 decimal strings
-// end-to-end (no JS number coercion). Networks are pinned to the same closed
-// set the core defines. The discriminated union on `source` exposes BOTH
-// synthesize_policy front-ends through a single tool input.
+// end-to-end. Networks are pinned to the same closed set the core defines.
+// The discriminated union on `source` exposes BOTH synthesize_policy
+// front-ends through a single tool input.
 //
 // This module is the SINGLE source of truth for these shapes. The MCP package
 // imports them here so its tool-shape bindings stay in step; the CLI imports
@@ -123,7 +123,21 @@ export const MandateSpecSchema = z
     })
         .optional(),
 })
-    .passthrough();
+    .passthrough()
+    // TS-F4/F6: a `recipients` allowlist is only meaningful against a SEP-41
+    // method whose arg 1 IS the recipient (SAC/SEP-41 `transfer(from, to,
+    // amount)` and SEP-41 `mint(to, amount)`). Without this gate the
+    // `to-ir.ts` lowering pins the allowlist to `RECIPIENT_ARG_INDEX = 1`
+    // for any contract+method, which would let a non-SEP-41 method's
+    // arg[1] (e.g. an amount, an op type, an arbitrary address payload)
+    // be silently constrained as if it were a recipient. Refusing
+    // non-SEP-41 methods at the boundary is the fail-closed shape.
+    .refine((v) => v.recipients === undefined ||
+    v.recipients.length === 0 ||
+    v.method === 'transfer' ||
+    v.method === 'mint', {
+    message: 'recipients is only valid when method is a SEP-41 method (transfer or mint); other methods do not have a recipient at arg[1]',
+});
 /** ComposeUserResponses mirrors the core. */
 export const ComposeUserResponsesSchema = z
     .object({
@@ -141,6 +155,21 @@ export const ComposeUserResponsesSchema = z
     swapRecipientAllowlist: z
         .array(z.string().refine(isStellarAddress, 'must be a Stellar address (G... or C...)'))
         .optional(),
+    // Per-asset oracle-price bound, one entry per asset. Reaches
+    // `compose-from-recording` and emits an `oracle_price` compare. Declared
+    // here because the object is `.passthrough()`: the field already worked
+    // undeclared, which left the accepted surface wider than the documented
+    // one. `decimals` is REQUIRED - oracle prices normalise to 9 dp and a
+    // threshold silently assumed to share that basis is what let a raw 14-dp
+    // bound permit everything.
+    oraclePriceBound: z
+        .array(z.object({
+        asset: z.string().refine(isStellarAddress, 'must be a Stellar address (G... or C...)'),
+        operator: z.enum(['eq', 'lt', 'lte', 'gt', 'gte']),
+        value: z.string().regex(/^[0-9]+$/),
+        decimals: z.number().int().min(0).max(U32_MAX),
+    }))
+        .optional(),
 })
     .passthrough();
 /** OzAdapterConfig - the per-network OZ built-in instance addresses. */
@@ -264,7 +293,12 @@ export const PredicateLeafSchema = z.lazy(() => z.union([
         windowSeconds: z.number().int().positive(),
     }),
     z.object({ kind: z.literal('now') }),
-    z.object({ kind: z.literal('valid_until') }),
+    // `valid_until` is NOT in the public predicate grammar: the encoder +
+    // decoder already throw on it, so accepting it here would let a
+    // hand-crafted payload through the schema and only surface a 200+
+    // character internal-commentary error at encode time. Drop it - the
+    // policy's expiry is carried at the install layer (MandateSpec +
+    // validUntilLedger) instead.
     z.object({
         kind: z.literal('invocation_count_in_window'),
         windowSecs: z.number().int().positive(),
@@ -424,20 +458,28 @@ const MandateSpecSchemaForRule = z
 // install/revoke/get_info schemas live HERE (after the helper) so the const
 // reference resolves at module init. They are the new tools on top of the
 // existing four.
-/** Pinned interpreter address (testnet). Mirrors DEPLOYMENTS.md:128.
+/** Pinned interpreter address (testnet).
  *  Single source for the MCP layer; do not embed elsewhere. */
-export const PINNED_INTERPRETER_TESTNET_ADDRESS = 'CDR4NLV22STCXFGZPNKDQTEANWLF7LZ6AJLY6B7CLJXKHDZGYJWIOKGP';
-/** Pinned interpreter address (mainnet). Mirrors DEPLOYMENTS.md:18. Mainnet
- *  has now been deployed (2026-08-04); the mainnet interpreter IS the binary
- *  that was exercised on testnet (same wasm sha256, see
- *  PINNED_INTERPRETER_WASM_SHA256). The address differs because instance
- *  ids are network-scoped. UNAUDITED at the time of writing - see
- *  DEPLOYMENTS.md:29-32 for the recorded decision and what is still pending. */
+export const PINNED_INTERPRETER_TESTNET_ADDRESS = 'CALHNU4LXZRKFAXYRBODTGDANTNXHJPBTJNYGLUWLIFIP24NWSGWIE4K';
+/** Pinned interpreter address (mainnet), deployed 2026-08-04.
+ *  UNAUDITED at the time of writing. */
 export const PINNED_INTERPRETER_MAINNET_ADDRESS = 'CALZAMUPREIRY4TULBEXIK77AUTOEJG63XLCPUWEHHQDOVK6ZVVS7VQ2';
-/** Pinned interpreter wasm sha256 (hex). Mirrors DEPLOYMENTS.md:156-157. */
+/** Pinned interpreter wasm sha256 (hex), mainnet.
+ *
+ *  The two networks no longer run the same binary. Testnet carries the
+ *  selector-leaf minimum and the signer-set cap; mainnet predates both. Read
+ *  the hash through `PINNED_INTERPRETER_WASM_SHA256_BY_NETWORK` rather than
+ *  this constant unless mainnet is specifically what is meant, or
+ *  `get_interpreter_info` will report a hash the queried network does not
+ *  run. */
 export const PINNED_INTERPRETER_WASM_SHA256 = '6e6c13d93e197aa380303a42cd120f5ddb080dd36ef2a343ee1dbd04ca52a443';
+/** Pinned interpreter wasm sha256 (hex), testnet. Byte-identical to the
+ *  artifact built from `contracts/policy-interpreter` at the commit that
+ *  introduced errors 216 and 217, verified by fetching the deployed wasm back
+ *  off chain. */
+export const PINNED_INTERPRETER_WASM_SHA256_TESTNET = 'a4d58bc88fd82bbb8e223941ba5889db919717fae92ced13f6f55bfe583b8e22';
 /** The grammar version the interpreter enforces (matches SELF_VERSION in
- *  packages/policy-interpreter/src/version.rs). */
+ *  contracts/policy-interpreter/src/version.rs). */
 export const PINNED_INTERPRETER_GRAMMAR_VERSION = 1;
 /** Default Soroban RPC for the install / revoke / info tools. The recorder
  *  keeps its own copy in record/rpc.ts because it hands back a fetcher rather
@@ -449,14 +491,18 @@ export const TESTNET_RPC_URL = 'https://soroban-testnet.stellar.org';
  *  RPC rather than always testnet. Public mainnet endpoint, the same one
  *  the deploy script hit during the 2026-08-04 mainnet rollout. */
 export const MAINNET_RPC_URL = 'https://mainnet.sorobanrpc.com';
-/** Pin + RPC lookup for the gate enforcement. The interpreters' wasm sha256
- *  is identical across both networks (the same binary was uploaded both
- *  places; DEPLOYMENTS.md:25-27), so `PINNED_INTERPRETER_WASM_SHA256` stays
- *  a single constant - only the addresses and RPCs are network-scoped. */
+/** Pin + RPC lookup for the gate enforcement. Addresses, RPCs and wasm
+ *  hashes are all network-scoped: the networks diverged when the
+ *  selector-leaf and signer-cap controls were deployed to testnet ahead of
+ *  mainnet. */
 export const PINNED_INTERPRETER_ADDRESS_BY_NETWORK = {
     testnet: PINNED_INTERPRETER_TESTNET_ADDRESS,
     mainnet: PINNED_INTERPRETER_MAINNET_ADDRESS,
 };
+export const PINNED_INTERPRETER_WASM_SHA256_BY_NETWORK = {
+    testnet: PINNED_INTERPRETER_WASM_SHA256_TESTNET,
+    mainnet: PINNED_INTERPRETER_WASM_SHA256,
+};
 export const RPC_URL_BY_NETWORK = {
     testnet: TESTNET_RPC_URL,
     mainnet: MAINNET_RPC_URL,
@@ -471,13 +517,26 @@ export const NETWORK_PASSPHRASES = {
     testnet: 'Test SDF Network ; September 2015',
     mainnet: 'Public Global Stellar Network ; September 2015',
 };
+// Stellar strkey shapes (StrKey base32, no checksum byte, version byte
+// 0x30/0x40 prefixed by the decoder, then 32 base32 chars giving a 56-char
+// total). The shared `isStellarAddress` helper accepts BOTH wallet (G...) and
+// contract (C...) addresses; the install schema has to distinguish them
+// because the smart account is a contract (C...) - a wallet address would
+// mean the rule is being installed against the WRONG account kind entirely.
+// `sourceAccount` is the signing wallet (G...).
+const STELLAR_CONTRACT_ADDRESS = /^C[2-7A-Z]{55}$/;
+const STELLAR_ACCOUNT_ADDRESS = /^G[2-7A-Z]{55}$/;
 export const InstallPolicyInputSchema = z
     .object({
     /** The smart account contract address (C...) that will receive the rule. */
-    smartAccount: z.string(),
+    smartAccount: z
+        .string()
+        .regex(STELLAR_CONTRACT_ADDRESS, 'smartAccount must be a Stellar contract address (C...)'),
     /** The signer that authorises the install (G... wallet). Used only for
      *  sequence number + auth nonce simulation; never persisted, never signed. */
-    sourceAccount: z.string(),
+    sourceAccount: z
+        .string()
+        .regex(STELLAR_ACCOUNT_ADDRESS, 'sourceAccount must be a Stellar account address (G...)'),
     /** Target network for the install. Selects which interpreter pin and
      *  which RPC URL are valid by default. Defaults to `testnet` so the
      *  pre-mainnet callers keep working: they were always pointing at
@@ -507,21 +566,63 @@ export const InstallPolicyInputSchema = z
      *  everything. Selecting `network: 'mainnet'` is NOT an opt-in -
      *  the mainnet pin is its own deny-by-default anchor. */
     allowUnpinnedInterpreter: z.boolean().optional(),
+    /** Opt-in to installing when a signer of this rule can already reach the
+     *  same calls through a context rule that has NO policy attached. OZ lets
+     *  the signer choose which rule authorises a call and enforces only that
+     *  rule's policies, so an unpoliced rule covering the same calls makes
+     *  this policy decorative. Default-deny, because the caller almost
+     *  certainly believes they are restricting something. */
+    allowAuthorityOverlap: z.boolean().optional(),
+    /** Skip the cross-rule authority scan entirely. The scan costs one RPC
+     *  read per rule on the account; skipping it means the response carries
+     *  no statement about what the signers can already do. */
+    skipAuthorityScan: z.boolean().optional(),
     /** Base fee in stroops; defaults to BASE_FEE (100). */
     baseFee: z.number().int().positive().optional(),
 })
     .refine((v) => Boolean(v.smartAccount) && Boolean(v.sourceAccount), {
     message: 'smartAccount and sourceAccount are required',
 });
+/** `merge_policy` input.
+ *
+ *  The tightening remedy for a cross-rule overlap: replace a rule's predicate
+ *  with the conjunction of it and a new one. Two transactions, in order,
+ *  because OZ refuses to re-attach a policy already on the rule - so the
+ *  caller runs `detach`, waits for it to confirm, then runs `reinstall`. */
+export const MergePolicyInputSchema = z
+    .object({
+    smartAccount: z
+        .string()
+        .regex(STELLAR_CONTRACT_ADDRESS, 'smartAccount must be a Stellar contract address (C...)'),
+    sourceAccount: z
+        .string()
+        .regex(STELLAR_ACCOUNT_ADDRESS, 'sourceAccount must be a Stellar account address (G...)'),
+    /** The rule whose predicate is being tightened. */
+    ruleId: z.number().int().nonnegative(),
+    /** The predicate to conjoin, base64 canonical ScVal, as emitted by
+     *  `synthesize_policy`. */
+    incomingPredicateBlobBase64: z.string().min(1),
+    /** Which half of the remedy to build. */
+    step: z.enum(['detach', 'reinstall']),
+    network: NetworkSchema.optional(),
+    rpcUrl: z.string().url().optional(),
+    allowUnpinnedRpcUrl: z.boolean().optional(),
+    baseFee: z.number().int().positive().optional(),
+})
+    .strict();
 export const RevokePolicyInputSchema = z
     .object({
     /** The smart account contract address (C...). */
-    smartAccount: z.string(),
+    smartAccount: z
+        .string()
+        .regex(STELLAR_CONTRACT_ADDRESS, 'smartAccount must be a Stellar contract address (C...)'),
     /** The wallet that will sign the removal. The ACCOUNT decides whether it
      *  accepts that signer; this schema does not assert a rule it cannot
      *  verify, since the account's source is not in this repo. Proven on
      *  testnet: the account's deployer can revoke. */
-    sourceAccount: z.string(),
+    sourceAccount: z
+        .string()
+        .regex(STELLAR_ACCOUNT_ADDRESS, 'sourceAccount must be a Stellar account address (G...)'),
     /** Target network for the revoke. Same `testnet`-default as install,
      *  so pre-mainnet callers keep working without an explicit flag. */
     network: NetworkSchema.optional(),
@@ -543,8 +644,15 @@ export const GetInterpreterInfoInputSchema = z.object({
     /** When true, perform an optional live `grammar_version()` RPC call to
      *  verify the deployed contract matches the pin. */
     verifyLive: z.boolean().optional(),
-    /** Optional RPC URL override. */
+    /** Optional RPC URL override. When `verifyLive` is true, the URL must
+     *  equal the pinned RPC for the selected network unless
+     *  `allowUnpinnedRpcUrl: true` is also set (same opt-in shape as
+     *  install/revoke - the live grammar_version() answer binds to whichever
+     *  RPC returned it). */
     rpcUrl: z.string().url().optional(),
+    /** Opt-in to using a non-pinned RPC URL when `verifyLive` is true. Same
+     *  semantics as install/revoke: the caller accepts the trust shift. */
+    allowUnpinnedRpcUrl: z.boolean().optional(),
 });
 // ===== Error envelope (canonical) =====
 //

package/dist/synth/compose-from-recording.d.ts

@@ -28,28 +28,23 @@ export interface ComposeUserResponses {
      *  invocation_count bound; absent -> FREQUENCY_BOUND_MISSING. */
     invocationLimit?: number;
     /** Per-asset oracle-price bound(s). Each entry lowers to a single
-     *  `oracle_price(asset) OP value` compare in the interpreter IR. Multiple
-     *  entries on the same asset emit multiple leaves. */
+     *  `oracle_price(asset) OP value` compare in the interpreter IR. */
     oraclePriceBound?: OraclePriceBound[];
     /** Minimum acceptable swap output per unit of input, as `num/den` (e.g.
-     *  `{num:'95',den:'100'}` = accept losing at most 5%). Emitted as a
-     *  slippage floor bounding the output arg against the input arg of the same
-     *  call.
-     *
-     *  REQUIRED to be supplied by the caller: it is never derived from the
-     *  recording. The recorded in/out pair is a price at one moment, and
-     *  freezing it as policy would deny ordinary trades as soon as the rate
-     *  moves. Absent, no floor is emitted and the existing unbounded-output
-     *  warning stands. */
+     *  `{num:'95',den:'100'}` = accept losing at most 5%). REQUIRED to be
+     *  supplied by the caller: never derived from the recording (the recorded
+     *  in/out pair is a price at one moment, and freezing it as policy would
+     *  deny ordinary trades as soon as the rate moves). Absent, no floor is
+     *  emitted and the existing unbounded-output warning stands. */
     swapMinOutRatio?: {
         num: string;
         den: string;
     };
     /** Recipient allowlist for a swap (call_arg[3] on SoroSwap's
-     *  swap_exact_tokens_for_tokens). When supplied, it REPLACES the default
-     *  pin. Absent -> the recipient is pinned to the recorded value (mirroring
-     *  SEP-41) and RECIPIENT_ALLOWLIST_EMPTY is surfaced as informational, never
-     *  a silent free pass. */
+     *  swap_exact_tokens_for_tokens). When supplied, REPLACES the default pin.
+     *  Absent -> recipient is pinned to the recorded value (mirroring SEP-41)
+     *  and RECIPIENT_ALLOWLIST_EMPTY surfaces as informational, never a silent
+     *  free pass. */
     swapRecipientAllowlist?: string[];
 }
 /** Composition options. */

package/dist/synth/compose-from-recording.js

@@ -1,52 +1,42 @@
-// src/synth/compose-from-recording.ts - facts + scope -> PolicyIR (OZ-shape + interpreter-shape).
-//
-// Composes the canonical IR rules the two backends compile FROM. Fail-closed
-// composition rules:
-//
-//   - identify the protocol of the top-level call (registry.identifyProtocol).
-//     When it is unknown (null), emit NO OZ-primitive-producing IR node: the
-//     scope is kept (CallContract + method) and every inferred bound is surfaced
-//     as a descriptive warning. An unrecognised call never compiles to a
-//     permissive OZ primitive.
+// src/synth/compose-from-recording.ts - facts + scope -> PolicyIR (OZ + interpreter).
 //
+// Fail-closed composition rules:
+//   - unknown top-level protocol (registry.identifyProtocol returns null) ->
+//     emit no OZ-primitive-producing IR node; scope is kept (CallContract + method)
+//     and every inferred bound surfaces as a descriptive warning. An unrecognised
+//     call never compiles to a permissive OZ primitive.
 //   - carry the recorded top-level function into `rule.scope.method` so the OZ
 //     adapter flags per-method scoping as not covered (CallContract permits every
-//     method on the contract; a per-method restriction needs the interpreter predicate).
-//
-//   - a `spending_limit` (window_spent(token, w) <= limit) is emitted ONLY when
-//     the caller supplies BOTH the limit (userResponses.limitAmount) and the
-//     window (userResponses.windowSeconds). A single recorded spend does NOT
-//     authorise that amount every window, so the observed amount is NEVER used as
-//     an auto-ceiling: a missing limit surfaces AMOUNT_BOUND_MISSING (the observed
-//     amount is offered as a suggestion), a missing window surfaces
-//     DURATION_UNSPECIFIED. EVERY spent token is handled - none is silently
-//     dropped; a single caller limit binds only an unambiguous single-token spend.
-//
-//   - incoming-only flows (e.g. Blend yield claim) emit an `invocation_count`
-//     bound ONLY when the caller supplies the count (userResponses.invocationLimit)
-//     and a window; otherwise FREQUENCY_BOUND_MISSING is surfaced with no
-//     fabricated count.
-//
-//   - the IR carries ONLY constraints justified by the recording (observed
-//     recipient allowlist) + explicit user input. Nothing invented: no oracle
-//     price fabricated from a slippage bound, no synthetic exact-path compare.
-//     Those needs are surfaced as descriptive warnings instead.
+//     method; a per-method restriction needs the interpreter predicate).
+//   - `spending_limit` (window_spent(token, w) <= limit) is emitted ONLY when
+//     the caller supplies BOTH limit (userResponses.limitAmount) AND window
+//     (userResponses.windowSeconds). A single recorded spend does NOT authorise
+//     that amount every window, so the observed amount is NEVER used as an
+//     auto-ceiling: missing limit -> AMOUNT_BOUND_MISSING (observed amount
+//     offered as a suggestion); missing window -> DURATION_UNSPECIFIED. EVERY
+//     spent token is handled - none is silently dropped.
+//   - incoming-only flows emit an `invocation_count` bound ONLY when the caller
+//     supplies both the count and the window; otherwise FREQUENCY_BOUND_MISSING
+//     with no fabricated count.
+//   - the IR carries ONLY constraints justified by the recording + explicit
+//     user input. Nothing invented: no oracle price fabricated from a slippage
+//     bound, no synthetic exact-path compare. Those needs surface as warnings.
 //
 // Split rule (P3 wiring): `ComposeResult` carries BOTH `ir` (OZ-shape) and
 // `interpreterIr` (predicate-shape). Each constraint is routed to EXACTLY ONE
 // adapter:
-//   - `compare window_spent(token, w) <= limit` where `token === scope.contract`
-//     and the protocol is known -> `ir` (OZ lowers to spending_limit).
-//   - everything else the compose step emits (recipient allowlists, per-method
-//     scoping via scope.method, invocation_count bounds, eq_seq swap paths,
-//     oracle_price bounds, AND window_spent where token != scope.contract, i.e.
-//     a SoroSwap input-token cap) -> `interpreterIr`.
+//   - `window_spent(token, w) <= limit` where `token === scope.contract` and
+//     protocol is known -> `ir` (OZ lowers to spending_limit).
+//   - everything else (recipient allowlists, per-method scope.method,
+//     invocation_count, eq_seq swap paths, oracle_price, AND window_spent
+//     where token != scope.contract i.e. SoroSwap input-token cap) ->
+//     `interpreterIr`.
 //
 // This prevents the interpreter adapter from emitting a duplicate
 // `window_spent` predicate leaf alongside an OZ `spending_limit` primitive
 // covering the same spend semantic - the two adapters never overlap.
 //
-// The default behavior is `deny_all` (OZ context rules are deny-by-default).
+// Default policy is `deny_all` (OZ context rules are deny-by-default).
 import { identifyProtocol } from "../registry/identify.js";
 /** Compose a PolicyIR pair from the lowered facts + the resolved scope.
  *  Pure (no randomness, no clock); same inputs -> byte-identical result. */
@@ -56,6 +46,15 @@ export function composeFromRecording(facts, scopeContract, topLevel, opts) {
     const warnings = [];
     const ozConstraints = [];
     const interpreterConstraints = [];
+    // Route to the matching IR. When the interpreter is enabled, constraints the
+    // OZ adapter cannot lower go there; otherwise they go to OZ (which flags them
+    // as uncovered) so today's warning-driven behaviour is preserved.
+    const routeToAdapter = (cond) => {
+        if (interpreterEnabled)
+            interpreterConstraints.push(cond);
+        else
+            ozConstraints.push(cond);
+    };
     const protocol = topLevel
         ? identifyProtocol(topLevel.contract, topLevel.fn, topLevel.args, opts.network)
         : null;
@@ -63,14 +62,15 @@ export function composeFromRecording(facts, scopeContract, topLevel, opts) {
     const windowSeconds = opts.userResponses?.windowSeconds;
     const limitAmount = opts.userResponses?.limitAmount;
     const spendTokens = Object.keys(facts.spendByToken);
-    // Outgoing spend -> one spending_limit per spent token. A single caller limit
-    // binds only an unambiguous single-token spend; a multi-token flow needs a
-    // per-token limit, so each unmatched token surfaces AMOUNT_BOUND_MISSING.
+    // Outgoing spend -> one spending_limit per spent token. A single caller
+    // limit binds only an unambiguous single-token spend; a multi-token flow
+    // needs a per-token limit, so each unmatched token surfaces
+    // AMOUNT_BOUND_MISSING.
     //
     // Routing: a `window_spent(token, w) <= limit` constraint goes to the OZ IR
     // only when token === scope.contract (OZ's spending_limit binds the
     // CallContract target, not a token parameter). Otherwise it goes to the
-    // interpreter IR (the interpreter lowers window_spent to a predicate leaf).
+    // interpreter IR.
     if (spendTokens.length > 0 && topLevel) {
         let durationFlagged = false;
         for (const token of spendTokens) {
@@ -96,24 +96,23 @@ export function composeFromRecording(facts, scopeContract, topLevel, opts) {
                 });
                 continue;
             }
-            if (windowSeconds !== undefined && limit !== undefined) {
-                const spendCond = {
+            if (windowSeconds !== undefined) {
+                // Rolling spend cap always goes to OZ (`spending_limit` is the audited
+                // implementation). The interpreter is NOT a fallback for token !=
+                // scopeContract: on chain it sees one authorized call, not the
+                // transaction's token movements, so it has no per-call amount to
+                // accumulate and the counter would never move. OZ reports the case it
+                // cannot cover (limit pins to the context contract) - the honest
+                // outcome; the old fallback produced an interpreter predicate that
+                // silently never bound.
+                ozConstraints.push({
                     op: 'compare',
                     compare: {
                         selector: { kind: 'window_spent', token, windowSeconds },
                         operator: 'lte',
                         value: limit,
                     },
-                };
-                // A rolling spend cap always goes to OZ, whose `spending_limit` is the
-                // audited implementation. The interpreter is NOT a fallback for the
-                // token != scopeContract case: on chain it sees one authorized call,
-                // not the transaction's token movements, so it has no per-call amount
-                // to accumulate and the counter would never move. OZ reports the case
-                // it cannot cover (it pins the limit to the context contract), which
-                // is the honest outcome - the old fallback produced an interpreter
-                // predicate that silently never bound.
-                ozConstraints.push(spendCond);
+                });
                 if (interpreterEnabled && token !== scopeContract) {
                     warnings.push(`rolling spend cap on ${token} cannot be enforced on chain: OZ spending_limit pins the limit to the context contract, and the interpreter cannot observe token movements. Bound the per-call value with an argument cap plus an invocation-count limit instead.`);
                 }
@@ -125,18 +124,18 @@ export function composeFromRecording(facts, scopeContract, topLevel, opts) {
     // Routed to the interpreter IR when interpreter is enabled (OZ cannot lower
     // invocation_count); otherwise to the OZ IR (which flags it as uncovered).
     //
-    // A recognised swap is NOT an incoming-only flow: it has an outgoing input leg
-    // whose spend simply was not attributed to the source account (the
-    // fee-sponsored / holder != source case). Its real restrictions - exact path,
-    // recipient, and the input-amount cap - come from the protocol-specific pass,
-    // so it does NOT get the incoming-only frequency prompt. A caller who wants to
+    // A recognised swap is NOT an incoming-only flow: it has an outgoing input
+    // leg whose spend simply was not attributed to the source account
+    // (fee-sponsored / holder != source). Its real restrictions - exact path,
+    // recipient, input-amount cap - come from the protocol-specific pass, so it
+    // does NOT get the incoming-only frequency prompt. A caller wanting to
     // rate-limit the swap can still supply an invocationLimit + window, which
     // lowers to an invocation_count for any flow.
     if (spendTokens.length === 0 && topLevel) {
         const invocationLimit = opts.userResponses?.invocationLimit;
         const isRecognisedSwap = protocol?.protocol === 'soroswap';
         if (known && windowSeconds !== undefined && invocationLimit !== undefined) {
-            const icCond = {
+            routeToAdapter({
                 op: 'compare',
                 compare: {
                     selector: { kind: 'invocation_count', windowSeconds },
@@ -146,13 +145,7 @@ export function composeFromRecording(facts, scopeContract, topLevel, opts) {
                     operator: 'lt',
                     value: String(invocationLimit),
                 },
-            };
-            if (interpreterEnabled) {
-                interpreterConstraints.push(icCond);
-            }
-            else {
-                ozConstraints.push(icCond);
-            }
+            });
         }
         else if (!isRecognisedSwap) {
             ambiguities.push({
@@ -168,7 +161,7 @@ export function composeFromRecording(facts, scopeContract, topLevel, opts) {
     const oracleBounds = opts.userResponses?.oraclePriceBound;
     if (oracleBounds) {
         for (const b of oracleBounds) {
-            const oracleCond = {
+            routeToAdapter({
                 op: 'compare',
                 compare: {
                     selector: { kind: 'oracle_price', asset: b.asset },
@@ -176,13 +169,7 @@ export function composeFromRecording(facts, scopeContract, topLevel, opts) {
                     value: b.value,
                     valueDecimals: b.decimals,
                 },
-            };
-            if (interpreterEnabled) {
-                interpreterConstraints.push(oracleCond);
-            }
-            else {
-                ozConstraints.push(oracleCond);
-            }
+            });
         }
     }
     // Observed recipient allowlist (SEP-41) is a real, recorded constraint the OZ
@@ -197,7 +184,7 @@ export function composeFromRecording(facts, scopeContract, topLevel, opts) {
         // the window_spent path above already consumed the limit, so the per-call
         // arg cap is skipped to avoid binding one limit to two different semantics.
         const swapInputAmountCap = spendTokens.length === 0 ? limitAmount : undefined;
-        appendProtocolSpecificConstraints(ozConstraints, interpreterConstraints, warnings, ambiguities, facts, topLevel, protocol, opts.userResponses?.swapRecipientAllowlist, swapInputAmountCap, opts.userResponses?.swapMinOutRatio, interpreterEnabled);
+        appendProtocolSpecificConstraints(interpreterConstraints, routeToAdapter, warnings, ambiguities, facts, topLevel, protocol, opts.userResponses?.swapRecipientAllowlist, swapInputAmountCap, opts.userResponses?.swapMinOutRatio, interpreterEnabled);
     }
     // `scope.method` is carried on BOTH IRs so each adapter produces a
     // self-consistent rule. The interpreter adapter lowers scope.method into a
@@ -239,32 +226,24 @@ export function composeFromRecording(facts, scopeContract, topLevel, opts) {
  *  SoroSwap's slippage / oracle / exact-path needs come from `userResponses`
  *  (oraclePriceBound + limitAmount) + the recorded path (eq_seq on
  *  call_arg[2]). */
-function appendProtocolSpecificConstraints(ozConstraints, interpreterConstraints, warnings, ambiguities, facts, topLevel, protocol, swapRecipientAllowlist, swapInputAmountCap, swapMinOutRatio, interpreterEnabled) {
-    // SEP-41 transfer / mint: the `to` arg (index 1) is the recipient. Emit it as
-    // a single-element allowlist; the interpreter adapter lowers it to `in`.
+function appendProtocolSpecificConstraints(interpreterConstraints, routeToAdapter, warnings, ambiguities, facts, topLevel, protocol, swapRecipientAllowlist, swapInputAmountCap, swapMinOutRatio, interpreterEnabled) {
+    // SEP-41 transfer / mint: the `to` arg (index 1) is the recipient. Emit a
+    // single-element allowlist; the interpreter adapter lowers it to `in`.
     // When interpreter is not enabled, route to OZ so the caller sees today's
-    // `value allowlist on arg 1 (arg allowlist)` warning.
+    // `value allowlist on arg 1` warning.
     if (protocol.protocol === 'sep41' && (protocol.fn === 'transfer' || protocol.fn === 'mint')) {
         const toArg = topLevel.args[1];
         if (toArg && toArg.type === 'address') {
-            const cond = {
+            routeToAdapter({
                 op: 'in',
                 selector: { kind: 'arg', argIndex: 1, scalarType: 'address' },
                 values: [toArg.value],
-            };
-            if (interpreterEnabled) {
-                interpreterConstraints.push(cond);
-            }
-            else {
-                ozConstraints.push(cond);
-            }
+            });
         }
     }
     // Blend submit / claim: the `to` arg is the beneficiary - it receives the
     // resulting position shares on `submit` and the claimed tokens on `claim`.
-    // That is the same role as the SEP-41 recipient above and the SoroSwap swap
-    // recipient below, so it is pinned to the recorded address the same way:
-    // without it a policy scoped to a pool and method still lets an agent send
+    // Without it, a policy scoped to a pool + method still lets an agent send
     // the proceeds anywhere. `from` and `spender` are deliberately NOT pinned -
     // the call already requires their authorisation, so binding them adds no
     // restriction the chain is not already enforcing.
@@ -273,25 +252,19 @@ function appendProtocolSpecificConstraints(ozConstraints, interpreterConstraints
         // claim(from, reserve_token_ids, to).
         const toArg = topLevel.args[2];
         if (toArg && toArg.type === 'address') {
-            const cond = {
+            routeToAdapter({
                 op: 'in',
                 selector: { kind: 'arg', argIndex: 2, scalarType: 'address' },
                 values: [toArg.value],
-            };
-            if (interpreterEnabled) {
-                interpreterConstraints.push(cond);
-            }
-            else {
-                ozConstraints.push(cond);
-            }
+            });
         }
     }
     // Blend `submit` ONLY (not `claim`, whose vec arg is a vec<u32> of
     // reserve_token_ids - no map fields to bind). The `requests` vec
     // (call_arg[3]) is a vec<Request{ address, amount, request_type }>. Each
-    // Request is the per-reserve action selector - 0 Supply, 1 Withdraw,
+    // Request is the per-reserve action selector (0 Supply, 1 Withdraw,
     // 2 SupplyCollateral, 3 WithdrawCollateral, 4 Borrow, 5 Repay, 6-9
-    // liquidation/auction fills. Pinning only one element is unsafe: a caller
+    // liquidation/auction fills). Pinning only one element is unsafe: a caller
     // can append a second element with a different action (WithdrawCollateral
     // -> Borrow on a different asset, any amount, then auction fills). Length
     // + per-element pinning is total; a quantifier over elements is not. If we
@@ -432,20 +405,14 @@ function appendProtocolSpecificConstraints(ozConstraints, interpreterConstraints
             inputArgIndex !== undefined &&
             inputAmountArg &&
             inputAmountArg.type === 'i128') {
-            const cond = {
+            routeToAdapter({
                 op: 'compare',
                 compare: {
                     selector: { kind: 'arg', argIndex: inputArgIndex, scalarType: 'i128' },
                     operator: 'lte',
                     value: swapInputAmountCap,
                 },
-            };
-            if (interpreterEnabled) {
-                interpreterConstraints.push(cond);
-            }
-            else {
-                ozConstraints.push(cond);
-            }
+            });
         }
         // Slippage floor: `out >= in * num/den`. Only when the caller supplied the
         // ratio - see `swapMinOutRatio`. Without it the output arg stays free,
@@ -457,19 +424,13 @@ function appendProtocolSpecificConstraints(ozConstraints, interpreterConstraints
             outMinArgIndex !== undefined &&
             inputAmountArg &&
             inputAmountArg.type === 'i128') {
-            const floor = {
+            routeToAdapter({
                 op: 'slippage_floor',
                 outArgIndex: outMinArgIndex,
                 inArgIndex: inputArgIndex,
                 num: minOutRatio.num,
                 den: minOutRatio.den,
-            };
-            if (interpreterEnabled) {
-                interpreterConstraints.push(floor);
-            }
-            else {
-                ozConstraints.push(floor);
-            }
+            });
         }
         // Swap recipient (call_arg[3]): when the caller supplies
         // swapRecipientAllowlist, emit it as an `in` constraint on the recipient
@@ -485,17 +446,11 @@ function appendProtocolSpecificConstraints(ozConstraints, interpreterConstraints
         // (today's behaviour, matching the other SoroSwap constraints).
         const recipientArg = topLevel.args[3];
         if (swapRecipientAllowlist && swapRecipientAllowlist.length > 0) {
-            const cond = {
+            routeToAdapter({
                 op: 'in',
                 selector: { kind: 'arg', argIndex: 3, scalarType: 'address' },
                 values: [...swapRecipientAllowlist],
-            };
-            if (interpreterEnabled) {
-                interpreterConstraints.push(cond);
-            }
-            else {
-                ozConstraints.push(cond);
-            }
+            });
         }
         else if (interpreterEnabled && recipientArg && recipientArg.type === 'address') {
             interpreterConstraints.push({