@crediolabs/policy-synth 0.1.2 → 0.1.3

package/dist/adapters/oz/adapter.js

@@ -1,7 +1,7 @@
-// src/adapters/oz/adapter.ts - the OZ Accounts CustodyAdapter (Path-A lowering).
+// src/adapters/oz/adapter.ts - the OZ Accounts CustodyAdapter.
 //
 // Compiles a PolicyIR to an OZ `ProposedPolicy` using OZ built-in policy
-// primitives (Path A). Only the constructs OZ can express natively are lowered:
+// primitives. Only the constructs OZ can express natively are lowered:
 //   scope.contract            -> ContextRuleType.call_contract (else default)
 //   expiry.validUntilLedger   -> ContextRuleDraft.validUntilLedger
 //   window_spent(t,w) <= L    -> `spending_limit` primitive
@@ -9,7 +9,7 @@
 // Anything needing a capability this backend lacks (oracle price, invocation
 // count, per-arg comparison/allowlist, guard, nested boolean predicate) is NOT
 // emitted: it is named in `uncovered` and `covered` is set false. Nothing is
-// silently dropped - the uncovered constructs are the Path-B markers.
+// silently dropped - the uncovered constructs are named instead.
 //
 // OZ built-in policy instance addresses are per-network deploy artifacts we do
 // not have yet (install is a later phase). They are injected via config; week-1
@@ -84,8 +84,8 @@ function lowerRule(rule, config) {
     const uncovered = [];
     const policyRefs = [];
     // scope -> context rule type. OZ scopes by contract (CallContract); a finer
-    // method-level restriction is a predicate concern and must be flagged Path-B
-    // because CallContract alone permits other methods on the same contract
+    // method-level restriction is a predicate concern and must be flagged as not
+    // covered because CallContract alone permits other methods on the same contract
     // (e.g. an unbounded approve alongside a capped transfer).
     const contextRuleType = rule.scope.contract !== undefined
         ? { kind: 'call_contract', contract: rule.scope.contract }
@@ -110,11 +110,11 @@ function lowerRule(rule, config) {
             uncovered.push('time expiry given as a unix timestamp (OZ context rules expire by ledger sequence; supply expiry.validUntilLedger)');
         }
     }
-    // guard -> Path B (applicability predicates are not an OZ built-in).
+    // guard -> not covered (applicability predicates are not an OZ built-in).
     if (rule.guard) {
         uncovered.push(`guard: ${describeCondition(rule.guard)}`);
     }
-    // constraints -> spending_limit where they match; else Path B. The OZ
+    // constraints -> spending_limit where they match; else not covered. The OZ
     // spending_limit policy takes `{ spending_limit: i128, period_ledgers: u32 }`
     // and has NO token param: it only accepts a CallContract context rule
     // (OnlyCallContractAllowed) and limits transfers of that context's contract,
@@ -144,7 +144,7 @@ function lowerRule(rule, config) {
     }
     // approval.threshold -> simple/weighted threshold primitive. A threshold < 1
     // is not a real M-of-N gate (0 approvals authorises everything), so refuse to
-    // emit a no-op primitive and flag it Path-B instead.
+    // emit a no-op primitive and flag it as not covered instead.
     if (rule.approval) {
         if (!Number.isInteger(rule.approval.threshold) || rule.approval.threshold < 1) {
             uncovered.push(`approval threshold ${rule.approval.threshold} is not a positive integer (a 0 or negative threshold is not an M-of-N gate)`);
@@ -203,17 +203,17 @@ function matchSpendingLimit(c) {
         return null;
     return { token: selector.token, limit: value, windowSeconds: selector.windowSeconds };
 }
-/** Human-readable descriptor for a construct the OZ Path-A backend cannot
- *  express, used to populate `uncovered` (the Path-B markers). */
+/** Human-readable descriptor for a construct the OZ built-in-primitive backend
+ *  cannot express, used to populate `uncovered`. */
 function describeCondition(cond) {
     switch (cond.op) {
         case 'in':
-            return `value allowlist on ${describeSelector(cond.selector)} (arg allowlist, Path B)`;
+            return `value allowlist on ${describeSelector(cond.selector)} (arg allowlist)`;
         case 'not':
-            return 'negated condition (predicate DSL, Path B)';
+            return 'negated condition (predicate DSL)';
         case 'and':
         case 'or':
-            return `nested ${cond.op} condition (predicate DSL, Path B)`;
+            return `nested ${cond.op} condition (predicate DSL)`;
         case 'compare': {
             const s = cond.compare.selector;
             switch (s.kind) {
@@ -224,16 +224,16 @@ function describeCondition(cond) {
                 case 'window_spent':
                     return `spend-window comparison with operator '${cond.compare.operator}' (only 'lte' lowers to spending_limit)`;
                 case 'amount':
-                    return `per-call amount comparison on ${s.token} (predicate DSL, Path B)`;
+                    return `per-call amount comparison on ${s.token} (predicate DSL)`;
                 case 'arg':
-                    return `argument comparison on arg ${s.argIndex} (predicate DSL, Path B)`;
+                    return `argument comparison on arg ${s.argIndex} (predicate DSL)`;
                 case 'calldata':
-                    return 'EVM calldata comparison (predicate DSL, Path B)';
+                    return 'EVM calldata comparison (predicate DSL)';
                 case 'value':
-                    return 'tx.value comparison (predicate DSL, Path B)';
+                    return 'tx.value comparison (predicate DSL)';
                 case 'now':
                 case 'valid_until':
-                    return 'time comparison (predicate DSL, Path B)';
+                    return 'time comparison (predicate DSL)';
             }
         }
     }

package/dist/mandate/to-ir.js

@@ -6,14 +6,14 @@
 //   contract/method  -> rule.scope
 //   spendingLimit    -> a `window_spent(token,window) <= limit` compare
 //   approvalThreshold-> rule.approval.threshold
-//   recipients       -> an `in` condition on the recipient arg (Path-B flagged
-//                       by the OZ adapter; that is expected)
+//   recipients       -> an `in` condition on the recipient arg (flagged as not
+//                       covered by the OZ adapter; that is expected)
 //   expiry           -> rule.expiry
 // The top-level default is `deny_all` (OZ context rules are deny-by-default).
 /** Arg index the recipient allowlist constrains. Pinned to the SEP-41
  *  `transfer(from, to, amount)` convention where `to` is arg 1. This condition
- *  is flagged Path-B by the OZ adapter (no built-in primitive expresses an arg
- *  allowlist), so the index only needs to be deterministic in week-1. */
+ *  is flagged as not covered by the OZ adapter (no built-in primitive expresses
+ *  an arg allowlist), so the index only needs to be deterministic in week-1. */
 const RECIPIENT_ARG_INDEX = 1;
 export function mandateToPolicyIR(spec) {
     const scope = { contract: spec.contract };

package/dist/mandate/types.d.ts

@@ -10,7 +10,7 @@ export interface MandateSpec {
     };
     /** -> OZ `simple_threshold` / `weighted_threshold` primitive. */
     approvalThreshold?: number;
-    /** Recipient allowlist -> an `in` arg condition (flagged Path-B in week-1). */
+    /** Recipient allowlist -> an `in` arg condition (not covered by an OZ built-in). */
     recipients?: string[];
     /** -> OZ context-rule expiry. */
     expiry?: {

package/dist/seams/types.d.ts

@@ -36,7 +36,7 @@ export interface CustodyCapabilities {
 export interface CompileResult {
     /** false => some IR construct this backend cannot express (see `uncovered`). */
     covered: boolean;
-    /** Human-readable list of unsupported constructs (the Path-B markers). */
+    /** Human-readable list of unsupported constructs. */
     uncovered: string[];
     /** The backend-native installable policy, assembled when a rule lowered. */
     proposed?: ProposedPolicy;

package/dist/synth/compose-from-recording.d.ts

@@ -22,7 +22,7 @@ export interface ComposeOptions {
     userResponses?: ComposeUserResponses;
 }
 /** Result of composition: the PolicyIR, any ambiguities surfaced during
- *  inference, and descriptive Path-B warnings for needs that are NOT expressed
+ *  inference, and descriptive warnings for needs that are NOT expressed
  *  as an IR node (so no fabricated constraint is emitted). The orchestrator
  *  carries ambiguities into `ProposedPolicy.ambiguities` and merges warnings
  *  into `ProposedPolicy.warnings`. */

package/dist/synth/compose-from-recording.js

@@ -1,17 +1,17 @@
-// src/synth/compose-from-recording.ts - facts + scope -> PolicyIR (Path A).
+// src/synth/compose-from-recording.ts - facts + scope -> PolicyIR.
 //
-// Composes the canonical IR rule the OZ Path-A backend can compile. Fail-closed
+// Composes the canonical IR rule the OZ built-in-primitive backend can compile. Fail-closed
 // composition rules:
 //
 //   - identify the protocol of the top-level call (registry.identifyProtocol).
 //     When it is unknown (null), emit NO OZ-primitive-producing IR node: the
 //     scope is kept (CallContract + method) and every inferred bound is surfaced
-//     as a descriptive Path-B warning. An unrecognised call never compiles to a
+//     as a descriptive warning. An unrecognised call never compiles to a
 //     permissive OZ primitive.
 //
 //   - carry the recorded top-level function into `rule.scope.method` so the OZ
-//     adapter flags per-method scoping Path-B (CallContract permits every method
-//     on the contract; a per-method restriction needs the interpreter predicate).
+//     adapter flags per-method scoping as not covered (CallContract permits every
+//     method on the contract; a per-method restriction needs the interpreter predicate).
 //
 //   - a `spending_limit` (window_spent(token, w) <= limit) is emitted ONLY when
 //     the caller supplies BOTH the limit (userResponses.limitAmount) and the
@@ -30,7 +30,7 @@
 //   - the IR carries ONLY constraints justified by the recording (observed
 //     recipient allowlist) + explicit user input. Nothing invented: no oracle
 //     price fabricated from a slippage bound, no synthetic exact-path compare.
-//     Those needs are surfaced as descriptive Path-B warnings instead.
+//     Those needs are surfaced as descriptive warnings instead.
 //
 // The default behavior is `deny_all` (OZ context rules are deny-by-default).
 import { identifyProtocol } from "../registry/identify.js";
@@ -57,7 +57,7 @@ export function composeFromRecording(facts, scopeContract, topLevel, opts) {
             if (observed === undefined)
                 continue;
             if (!known) {
-                warnings.push(`spend of ${observed} (token ${token}) not bounded: unrecognised protocol, spend cap needs the interpreter predicate (Path B)`);
+                warnings.push(`spend of ${observed} (token ${token}) not bounded: unrecognised protocol, spend cap needs the interpreter predicate`);
                 continue;
             }
             const limit = spendTokens.length === 1 ? limitAmount : undefined;
@@ -106,11 +106,11 @@ export function composeFromRecording(facts, scopeContract, topLevel, opts) {
                 code: 'FREQUENCY_BOUND_MISSING',
                 question: 'Incoming-only flow - what max invocations per window should the policy enforce?',
             });
-            warnings.push('frequency bound needed for the incoming-only flow (interpreter/Path B); no invocation cap inferred');
+            warnings.push('frequency bound needed for the incoming-only flow (needs the interpreter predicate); no invocation cap inferred');
         }
     }
     // Observed recipient allowlist (SEP-41) is a real, recorded constraint the OZ
-    // adapter flags Path-B. Unknown protocols emit nothing here.
+    // adapter flags as not covered. Unknown protocols emit nothing here.
     if (topLevel && protocol !== null) {
         appendProtocolSpecificConstraints(constraints, warnings, facts, topLevel, protocol);
     }
@@ -134,11 +134,11 @@ export function composeFromRecording(facts, scopeContract, topLevel, opts) {
 }
 /** Add the constraints justified by the recording that the OZ backend cannot
  *  express natively (the SEP-41 recipient the transfer moved to). The OZ adapter
- *  flags them Path-B. SoroSwap's slippage / oracle / exact-path needs are
+ *  flags them as not covered. SoroSwap's slippage / oracle / exact-path needs are
  *  surfaced as descriptive warnings, NOT as fabricated comparison nodes. */
 function appendProtocolSpecificConstraints(constraints, warnings, facts, topLevel, protocol) {
     // SEP-41 transfer / mint: the `to` arg (index 1) is the recipient. Emit it as
-    // a single-element allowlist; the OZ adapter flags it Path-B.
+    // a single-element allowlist; the OZ adapter flags it as not covered.
     if (protocol.protocol === 'sep41' && (protocol.fn === 'transfer' || protocol.fn === 'mint')) {
         const toArg = topLevel.args[1];
         if (toArg && toArg.type === 'address') {
@@ -157,6 +157,6 @@ function appendProtocolSpecificConstraints(constraints, warnings, facts, topLeve
         const paths = facts.allowedPaths?.[topLevel.contract];
         const route = paths?.length === 1 ? paths[0] : undefined;
         const pathText = route && route.length > 0 ? `; observed path: ${route.join(' -> ')}` : '';
-        warnings.push(`SoroSwap swap: slippage / oracle price bound and exact hop path need the interpreter predicate (Path B)${pathText}`);
+        warnings.push(`SoroSwap swap: slippage / oracle price bound and exact hop path need the interpreter predicate${pathText}`);
     }
 }

package/dist/synth/lower.d.ts

@@ -4,7 +4,7 @@ export interface IntentFacts {
     callTargets: string[];
     functionsByContract: Record<string, string[]>;
     /** Aggregate outgoing spend per token (i128-safe decimal string). A single
-     *  token entry is the Path-A prerequisite for `spending_limit`. Movements
+     *  token entry is the prerequisite for `spending_limit`. Movements
      *  with from != sourceAccount are NOT counted as "spend" by this synth
      *  (incoming yield, refund, etc.). */
     spendByToken: Record<string, string>;
@@ -15,7 +15,7 @@ export interface IntentFacts {
     sharedRouter?: string;
     /** Router hop paths, keyed by target contract. SoroSwap exposes its `path`
      *  arg directly on the top-level call; this is the input the compose step
-     *  passes to a per-arg `in` condition (flagged Path-B by the OZ adapter). */
+     *  passes to a per-arg `in` condition (flagged as not covered by the OZ adapter). */
     allowedPaths?: Record<string, string[][]>;
 }
 /** Lower a recorded transaction to the canonical IntentFacts. Pure (no

package/dist/synth/synthesize-from-mandate.js

@@ -4,12 +4,12 @@
 // MandateSpec is lowered deterministically to a PolicyIR and compiled by the OZ
 // adapter to a ProposedPolicy. No decoding, no inference, so parseConfidence is
 // the full/not-applicable value. Constructs the OZ built-in primitives cannot
-// express (compile's `uncovered`) are surfaced in `ProposedPolicy.warnings` as
-// Path-B markers rather than failing the call - the covered primitives still
-// install; the uncovered ones are reported.
+// express (compile's `uncovered`) are surfaced in `ProposedPolicy.warnings`
+// rather than failing the call - the covered primitives still install; the
+// uncovered ones are reported.
 import { createOzAdapter } from "../adapters/oz/adapter.js";
 import { mandateToPolicyIR } from "../mandate/to-ir.js";
-const PATH_B_PREFIX = 'Path B (not covered by OZ built-in primitives): ';
+const UNCOVERED_PREFIX = 'Not covered by OZ built-in primitives: ';
 export function synthesizeFromMandate(spec, ozConfig) {
     const ir = mandateToPolicyIR(spec);
     const adapter = createOzAdapter(ozConfig);
@@ -28,7 +28,7 @@ export function synthesizeFromMandate(spec, ozConfig) {
     }
     const proposed = {
         ...result.proposed,
-        warnings: result.uncovered.map((u) => `${PATH_B_PREFIX}${u}`),
+        warnings: result.uncovered.map((u) => `${UNCOVERED_PREFIX}${u}`),
     };
     return { ok: true, data: proposed };
 }

package/dist/synth/synthesize-from-recording.js

@@ -11,7 +11,7 @@
 //   4. `composeFromRecording(facts, scope, opts)` -> PolicyIR + ambiguities.
 //   5. `ozAdapter.compile(ir)` -> CompileResult.
 //   6. Assemble ProposedPolicy carrying parseConfidence (from tx), warnings
-//      (the OZ `uncovered` Path-B markers, prefixed), and ambiguities
+//      (the OZ `uncovered` markers, prefixed), and ambiguities
 //      (DURATION_UNSPECIFIED etc.).
 //
 // Determinism: same (tx, opts, ozConfig) -> byte-identical ProposedPolicy.
@@ -21,7 +21,7 @@ import { SOROBAN_LIMITS, } from "../types.js";
 import { composeFromRecording, } from "./compose-from-recording.js";
 import { lower } from "./lower.js";
 import { decideScope } from "./scope.js";
-const PATH_B_PREFIX = 'Path B (not covered by OZ built-in primitives): ';
+const UNCOVERED_PREFIX = 'Not covered by OZ built-in primitives: ';
 /** Synthesize a ProposedPolicy from a recorded transaction. */
 export function synthesizeFromRecording(tx, opts, ozConfig) {
     // 0. validate inputs (fail closed - never synthesize from garbage).
@@ -68,7 +68,7 @@ export function synthesizeFromRecording(tx, opts, ozConfig) {
         return scopeRes;
     const scope = scopeRes.data;
     if (scope.kind !== 'call_contract') {
-        // A default scope on the recording-path is not currently a Path-A flow;
+        // A default scope on the recording-path is not currently a covered flow;
         // surface SYNTHESIS_ERROR so the orchestrator never silently emits an
         // over-broad default-scoped policy.
         return {
@@ -108,8 +108,8 @@ export function synthesizeFromRecording(tx, opts, ozConfig) {
         ...compileRes.proposed,
         parseConfidence: { ...tx.parseConfidence },
         warnings: [
-            ...compileRes.uncovered.map((u) => `${PATH_B_PREFIX}${u}`),
-            ...composed.warnings.map((w) => `${PATH_B_PREFIX}${w}`),
+            ...compileRes.uncovered.map((u) => `${UNCOVERED_PREFIX}${u}`),
+            ...composed.warnings.map((w) => `${UNCOVERED_PREFIX}${w}`),
         ],
         ambiguities: mergeAmbiguities(composed.ambiguities, scope.ambiguities),
     };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crediolabs/policy-synth",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "license": "MIT",
   "description": "Off-chain TypeScript synthesis core for the OZ Accounts Policy Builder. Records Soroban transactions, synthesises the minimal policy that permits exactly that flow, verifies it, and returns an unsigned install transaction.",
   "type": "module",

package/src/adapters/oz/adapter.ts

@@ -1,7 +1,7 @@
-// src/adapters/oz/adapter.ts - the OZ Accounts CustodyAdapter (Path-A lowering).
+// src/adapters/oz/adapter.ts - the OZ Accounts CustodyAdapter.
 //
 // Compiles a PolicyIR to an OZ `ProposedPolicy` using OZ built-in policy
-// primitives (Path A). Only the constructs OZ can express natively are lowered:
+// primitives. Only the constructs OZ can express natively are lowered:
 //   scope.contract            -> ContextRuleType.call_contract (else default)
 //   expiry.validUntilLedger   -> ContextRuleDraft.validUntilLedger
 //   window_spent(t,w) <= L    -> `spending_limit` primitive
@@ -9,7 +9,7 @@
 // Anything needing a capability this backend lacks (oracle price, invocation
 // count, per-arg comparison/allowlist, guard, nested boolean predicate) is NOT
 // emitted: it is named in `uncovered` and `covered` is set false. Nothing is
-// silently dropped - the uncovered constructs are the Path-B markers.
+// silently dropped - the uncovered constructs are named instead.
 //
 // OZ built-in policy instance addresses are per-network deploy artifacts we do
 // not have yet (install is a later phase). They are injected via config; week-1
@@ -132,8 +132,8 @@ function lowerRule(rule: IRPolicyRule, config: OzAdapterConfig): LoweredRule {
   const policyRefs: PolicyRef[] = []
 
   // scope -> context rule type. OZ scopes by contract (CallContract); a finer
-  // method-level restriction is a predicate concern and must be flagged Path-B
-  // because CallContract alone permits other methods on the same contract
+  // method-level restriction is a predicate concern and must be flagged as not
+  // covered because CallContract alone permits other methods on the same contract
   // (e.g. an unbounded approve alongside a capped transfer).
   const contextRuleType: ContextRuleDraft['contextRuleType'] =
     rule.scope.contract !== undefined
@@ -171,12 +171,12 @@ function lowerRule(rule: IRPolicyRule, config: OzAdapterConfig): LoweredRule {
     }
   }
 
-  // guard -> Path B (applicability predicates are not an OZ built-in).
+  // guard -> not covered (applicability predicates are not an OZ built-in).
   if (rule.guard) {
     uncovered.push(`guard: ${describeCondition(rule.guard)}`)
   }
 
-  // constraints -> spending_limit where they match; else Path B. The OZ
+  // constraints -> spending_limit where they match; else not covered. The OZ
   // spending_limit policy takes `{ spending_limit: i128, period_ledgers: u32 }`
   // and has NO token param: it only accepts a CallContract context rule
   // (OnlyCallContractAllowed) and limits transfers of that context's contract,
@@ -209,7 +209,7 @@ function lowerRule(rule: IRPolicyRule, config: OzAdapterConfig): LoweredRule {
 
   // approval.threshold -> simple/weighted threshold primitive. A threshold < 1
   // is not a real M-of-N gate (0 approvals authorises everything), so refuse to
-  // emit a no-op primitive and flag it Path-B instead.
+  // emit a no-op primitive and flag it as not covered instead.
   if (rule.approval) {
     if (!Number.isInteger(rule.approval.threshold) || rule.approval.threshold < 1) {
       uncovered.push(
@@ -281,17 +281,17 @@ function matchSpendingLimit(c: IRCondition): SpendingLimitMatch | null {
   return { token: selector.token, limit: value, windowSeconds: selector.windowSeconds }
 }
 
-/** Human-readable descriptor for a construct the OZ Path-A backend cannot
- *  express, used to populate `uncovered` (the Path-B markers). */
+/** Human-readable descriptor for a construct the OZ built-in-primitive backend
+ *  cannot express, used to populate `uncovered`. */
 function describeCondition(cond: IRCondition): string {
   switch (cond.op) {
     case 'in':
-      return `value allowlist on ${describeSelector(cond.selector)} (arg allowlist, Path B)`
+      return `value allowlist on ${describeSelector(cond.selector)} (arg allowlist)`
     case 'not':
-      return 'negated condition (predicate DSL, Path B)'
+      return 'negated condition (predicate DSL)'
     case 'and':
     case 'or':
-      return `nested ${cond.op} condition (predicate DSL, Path B)`
+      return `nested ${cond.op} condition (predicate DSL)`
     case 'compare': {
       const s = cond.compare.selector
       switch (s.kind) {
@@ -302,16 +302,16 @@ function describeCondition(cond: IRCondition): string {
         case 'window_spent':
           return `spend-window comparison with operator '${cond.compare.operator}' (only 'lte' lowers to spending_limit)`
         case 'amount':
-          return `per-call amount comparison on ${s.token} (predicate DSL, Path B)`
+          return `per-call amount comparison on ${s.token} (predicate DSL)`
         case 'arg':
-          return `argument comparison on arg ${s.argIndex} (predicate DSL, Path B)`
+          return `argument comparison on arg ${s.argIndex} (predicate DSL)`
         case 'calldata':
-          return 'EVM calldata comparison (predicate DSL, Path B)'
+          return 'EVM calldata comparison (predicate DSL)'
         case 'value':
-          return 'tx.value comparison (predicate DSL, Path B)'
+          return 'tx.value comparison (predicate DSL)'
         case 'now':
         case 'valid_until':
-          return 'time comparison (predicate DSL, Path B)'
+          return 'time comparison (predicate DSL)'
       }
     }
   }

package/src/mandate/to-ir.ts

@@ -6,8 +6,8 @@
 //   contract/method  -> rule.scope
 //   spendingLimit    -> a `window_spent(token,window) <= limit` compare
 //   approvalThreshold-> rule.approval.threshold
-//   recipients       -> an `in` condition on the recipient arg (Path-B flagged
-//                       by the OZ adapter; that is expected)
+//   recipients       -> an `in` condition on the recipient arg (flagged as not
+//                       covered by the OZ adapter; that is expected)
 //   expiry           -> rule.expiry
 // The top-level default is `deny_all` (OZ context rules are deny-by-default).
 
@@ -16,8 +16,8 @@ import type { MandateSpec } from './types.ts'
 
 /** Arg index the recipient allowlist constrains. Pinned to the SEP-41
  *  `transfer(from, to, amount)` convention where `to` is arg 1. This condition
- *  is flagged Path-B by the OZ adapter (no built-in primitive expresses an arg
- *  allowlist), so the index only needs to be deterministic in week-1. */
+ *  is flagged as not covered by the OZ adapter (no built-in primitive expresses
+ *  an arg allowlist), so the index only needs to be deterministic in week-1. */
 const RECIPIENT_ARG_INDEX = 1
 
 export function mandateToPolicyIR(spec: MandateSpec): PolicyIR {

package/src/mandate/types.ts

@@ -14,7 +14,7 @@ export interface MandateSpec {
   spendingLimit?: { token: string; limit: string; windowSeconds: number }
   /** -> OZ `simple_threshold` / `weighted_threshold` primitive. */
   approvalThreshold?: number
-  /** Recipient allowlist -> an `in` arg condition (flagged Path-B in week-1). */
+  /** Recipient allowlist -> an `in` arg condition (not covered by an OZ built-in). */
   recipients?: string[]
   /** -> OZ context-rule expiry. */
   expiry?: { validUntilLedger?: number; validUntilUnixSeconds?: number }

package/src/seams/types.ts

@@ -48,7 +48,7 @@ export interface CustodyCapabilities {
 export interface CompileResult {
   /** false => some IR construct this backend cannot express (see `uncovered`). */
   covered: boolean
-  /** Human-readable list of unsupported constructs (the Path-B markers). */
+  /** Human-readable list of unsupported constructs. */
   uncovered: string[]
   /** The backend-native installable policy, assembled when a rule lowered. */
   proposed?: ProposedPolicy

package/src/synth/compose-from-recording.ts

@@ -1,17 +1,17 @@
-// src/synth/compose-from-recording.ts - facts + scope -> PolicyIR (Path A).
+// src/synth/compose-from-recording.ts - facts + scope -> PolicyIR.
 //
-// Composes the canonical IR rule the OZ Path-A backend can compile. Fail-closed
+// Composes the canonical IR rule the OZ built-in-primitive backend can compile. Fail-closed
 // composition rules:
 //
 //   - identify the protocol of the top-level call (registry.identifyProtocol).
 //     When it is unknown (null), emit NO OZ-primitive-producing IR node: the
 //     scope is kept (CallContract + method) and every inferred bound is surfaced
-//     as a descriptive Path-B warning. An unrecognised call never compiles to a
+//     as a descriptive warning. An unrecognised call never compiles to a
 //     permissive OZ primitive.
 //
 //   - carry the recorded top-level function into `rule.scope.method` so the OZ
-//     adapter flags per-method scoping Path-B (CallContract permits every method
-//     on the contract; a per-method restriction needs the interpreter predicate).
+//     adapter flags per-method scoping as not covered (CallContract permits every
+//     method on the contract; a per-method restriction needs the interpreter predicate).
 //
 //   - a `spending_limit` (window_spent(token, w) <= limit) is emitted ONLY when
 //     the caller supplies BOTH the limit (userResponses.limitAmount) and the
@@ -30,7 +30,7 @@
 //   - the IR carries ONLY constraints justified by the recording (observed
 //     recipient allowlist) + explicit user input. Nothing invented: no oracle
 //     price fabricated from a slippage bound, no synthetic exact-path compare.
-//     Those needs are surfaced as descriptive Path-B warnings instead.
+//     Those needs are surfaced as descriptive warnings instead.
 //
 // The default behavior is `deny_all` (OZ context rules are deny-by-default).
 
@@ -62,7 +62,7 @@ export interface ComposeOptions {
 }
 
 /** Result of composition: the PolicyIR, any ambiguities surfaced during
- *  inference, and descriptive Path-B warnings for needs that are NOT expressed
+ *  inference, and descriptive warnings for needs that are NOT expressed
  *  as an IR node (so no fabricated constraint is emitted). The orchestrator
  *  carries ambiguities into `ProposedPolicy.ambiguities` and merges warnings
  *  into `ProposedPolicy.warnings`. */
@@ -104,7 +104,7 @@ export function composeFromRecording(
 
       if (!known) {
         warnings.push(
-          `spend of ${observed} (token ${token}) not bounded: unrecognised protocol, spend cap needs the interpreter predicate (Path B)`
+          `spend of ${observed} (token ${token}) not bounded: unrecognised protocol, spend cap needs the interpreter predicate`
         )
         continue
       }
@@ -156,13 +156,13 @@ export function composeFromRecording(
         question: 'Incoming-only flow - what max invocations per window should the policy enforce?',
       })
       warnings.push(
-        'frequency bound needed for the incoming-only flow (interpreter/Path B); no invocation cap inferred'
+        'frequency bound needed for the incoming-only flow (needs the interpreter predicate); no invocation cap inferred'
       )
     }
   }
 
   // Observed recipient allowlist (SEP-41) is a real, recorded constraint the OZ
-  // adapter flags Path-B. Unknown protocols emit nothing here.
+  // adapter flags as not covered. Unknown protocols emit nothing here.
   if (topLevel && protocol !== null) {
     appendProtocolSpecificConstraints(constraints, warnings, facts, topLevel, protocol)
   }
@@ -189,7 +189,7 @@ export function composeFromRecording(
 
 /** Add the constraints justified by the recording that the OZ backend cannot
  *  express natively (the SEP-41 recipient the transfer moved to). The OZ adapter
- *  flags them Path-B. SoroSwap's slippage / oracle / exact-path needs are
+ *  flags them as not covered. SoroSwap's slippage / oracle / exact-path needs are
  *  surfaced as descriptive warnings, NOT as fabricated comparison nodes. */
 function appendProtocolSpecificConstraints(
   constraints: IRCondition[],
@@ -199,7 +199,7 @@ function appendProtocolSpecificConstraints(
   protocol: IdentifiedProtocol
 ): void {
   // SEP-41 transfer / mint: the `to` arg (index 1) is the recipient. Emit it as
-  // a single-element allowlist; the OZ adapter flags it Path-B.
+  // a single-element allowlist; the OZ adapter flags it as not covered.
   if (protocol.protocol === 'sep41' && (protocol.fn === 'transfer' || protocol.fn === 'mint')) {
     const toArg = topLevel.args[1]
     if (toArg && toArg.type === 'address') {
@@ -220,7 +220,7 @@ function appendProtocolSpecificConstraints(
     const route = paths?.length === 1 ? paths[0] : undefined
     const pathText = route && route.length > 0 ? `; observed path: ${route.join(' -> ')}` : ''
     warnings.push(
-      `SoroSwap swap: slippage / oracle price bound and exact hop path need the interpreter predicate (Path B)${pathText}`
+      `SoroSwap swap: slippage / oracle price bound and exact hop path need the interpreter predicate${pathText}`
     )
   }
 }

package/src/synth/lower.ts

@@ -16,7 +16,7 @@ export interface IntentFacts {
   callTargets: string[]
   functionsByContract: Record<string, string[]>
   /** Aggregate outgoing spend per token (i128-safe decimal string). A single
-   *  token entry is the Path-A prerequisite for `spending_limit`. Movements
+   *  token entry is the prerequisite for `spending_limit`. Movements
    *  with from != sourceAccount are NOT counted as "spend" by this synth
    *  (incoming yield, refund, etc.). */
   spendByToken: Record<string, string>
@@ -27,7 +27,7 @@ export interface IntentFacts {
   sharedRouter?: string
   /** Router hop paths, keyed by target contract. SoroSwap exposes its `path`
    *  arg directly on the top-level call; this is the input the compose step
-   *  passes to a per-arg `in` condition (flagged Path-B by the OZ adapter). */
+   *  passes to a per-arg `in` condition (flagged as not covered by the OZ adapter). */
   allowedPaths?: Record<string, string[][]>
 }
 

package/src/synth/synthesize-from-mandate.ts

@@ -4,9 +4,9 @@
 // MandateSpec is lowered deterministically to a PolicyIR and compiled by the OZ
 // adapter to a ProposedPolicy. No decoding, no inference, so parseConfidence is
 // the full/not-applicable value. Constructs the OZ built-in primitives cannot
-// express (compile's `uncovered`) are surfaced in `ProposedPolicy.warnings` as
-// Path-B markers rather than failing the call - the covered primitives still
-// install; the uncovered ones are reported.
+// express (compile's `uncovered`) are surfaced in `ProposedPolicy.warnings`
+// rather than failing the call - the covered primitives still install; the
+// uncovered ones are reported.
 
 import type { OzAdapterConfig } from '../adapters/oz/adapter.ts'
 import { createOzAdapter } from '../adapters/oz/adapter.ts'
@@ -15,7 +15,7 @@ import { mandateToPolicyIR } from '../mandate/to-ir.ts'
 import type { MandateSpec } from '../mandate/types.ts'
 import type { ProposedPolicy } from '../types.ts'
 
-const PATH_B_PREFIX = 'Path B (not covered by OZ built-in primitives): '
+const UNCOVERED_PREFIX = 'Not covered by OZ built-in primitives: '
 
 export function synthesizeFromMandate(
   spec: MandateSpec,
@@ -40,7 +40,7 @@ export function synthesizeFromMandate(
 
   const proposed: ProposedPolicy = {
     ...result.proposed,
-    warnings: result.uncovered.map((u) => `${PATH_B_PREFIX}${u}`),
+    warnings: result.uncovered.map((u) => `${UNCOVERED_PREFIX}${u}`),
   }
   return { ok: true, data: proposed }
 }

package/src/synth/synthesize-from-recording.ts

@@ -11,7 +11,7 @@
 //   4. `composeFromRecording(facts, scope, opts)` -> PolicyIR + ambiguities.
 //   5. `ozAdapter.compile(ir)` -> CompileResult.
 //   6. Assemble ProposedPolicy carrying parseConfidence (from tx), warnings
-//      (the OZ `uncovered` Path-B markers, prefixed), and ambiguities
+//      (the OZ `uncovered` markers, prefixed), and ambiguities
 //      (DURATION_UNSPECIFIED etc.).
 //
 // Determinism: same (tx, opts, ozConfig) -> byte-identical ProposedPolicy.
@@ -34,7 +34,7 @@ import {
 import { lower } from './lower.ts'
 import { decideScope, type ScopeDecision } from './scope.ts'
 
-const PATH_B_PREFIX = 'Path B (not covered by OZ built-in primitives): '
+const UNCOVERED_PREFIX = 'Not covered by OZ built-in primitives: '
 
 /** Top-level orchestrator inputs. `userResponses` carries the LLM-collected
  *  answers to the ambiguity prompts (windowSeconds, validUntilLedger,
@@ -98,7 +98,7 @@ export function synthesizeFromRecording(
   if (!scopeRes.ok) return scopeRes
   const scope: ScopeDecision = scopeRes.data
   if (scope.kind !== 'call_contract') {
-    // A default scope on the recording-path is not currently a Path-A flow;
+    // A default scope on the recording-path is not currently a covered flow;
     // surface SYNTHESIS_ERROR so the orchestrator never silently emits an
     // over-broad default-scoped policy.
     return {
@@ -142,8 +142,8 @@ export function synthesizeFromRecording(
     ...compileRes.proposed,
     parseConfidence: { ...tx.parseConfidence },
     warnings: [
-      ...compileRes.uncovered.map((u) => `${PATH_B_PREFIX}${u}`),
-      ...composed.warnings.map((w) => `${PATH_B_PREFIX}${w}`),
+      ...compileRes.uncovered.map((u) => `${UNCOVERED_PREFIX}${u}`),
+      ...composed.warnings.map((w) => `${UNCOVERED_PREFIX}${w}`),
     ],
     ambiguities: mergeAmbiguities(composed.ambiguities, scope.ambiguities),
   }