@crediolabs/policy-synth 0.1.9 → 0.1.11

package/dist/registry/protocols.js

@@ -139,10 +139,98 @@ export const SOROSWAP_ABI = {
         ],
     },
 };
+/** OpenZeppelin smart-account ABI subset.
+ *
+ *  Why this lives in the recogniser: every user's smart account has a
+ *  different C-address, so a per-deployment pin would never cover them.
+ *  What is the same across every OpenZeppelin multisig account is the
+ *  small set of public context-rule entrypoints. A recording that
+ *  invokes `batch_add_signer(u32, vec<signer>)` on an arbitrary contract
+ *  is overwhelmingly likely to be calling the user's own OpenZeppelin
+ *  smart account (the canonical reason this product exists); we
+ *  recognise that pattern by interface, the same way SEP-41 is
+ *  recognised by interface.
+ *
+ *  SECURITY PROPERTY (load-bearing):
+ *   - Recognition claims the call TARGETS a particular protocol. We
+ *     only claim `oz_account` when the (fn, args) shape uniquely matches
+ *     one of the three entrypoints below AND the call looks like a real
+ *     context-rule operation. The match is exact: off-by-one arg count,
+ *     off-by-one arg type, or a method name close-but-wrong returns null
+ *     (fail-closed). A contract that incidentally happens to expose a
+ *     single matching fn is not sufficient - the recorder requires ALL
+ *     invocations to individually match, so a hostile contract with
+ *     exactly one matching fn would still contribute to the unknown
+ *     bucket for any other calls.
+ *   - We do NOT claim `oz_account` for unknown calls, for arg-shape
+ *     mismatches, or for calls where the recorder could not pin down
+ *     the (fn, args) shape. The freshness gate then runs at the same
+ *     1.0 threshold - lowering the gate for unknown protocols remains
+ *     a separate, opt-in production override (see RecordInput below).
+ *
+ *  ABI source: packages/policy-interpreter/tests/fixtures/multisig_account_example.wasm,
+ *  pinned from the OpenZeppelin Reloaded `multisig_account_example`
+ *  contract (commit ef82b65, fetched 2026-07-28).
+ *
+ *  SCOPE NOTE: this ABI only covers the three entrypoints whose args
+ *  map cleanly onto the normalised `AbiArgType` vocabulary (u32, vec,
+ *  ...). `add_context_rule` - the install path - takes `(Symbol,
+ *  String, Option<u32>, Vec<SignerKey>, Map<Address, Val>)`. The
+ *  `String`, `Option<u32>` (`scvVoid`), and `Map<...>` arg types are
+ *  not in the AbiArgType set today (the recogniser's `argsMatchAbi`
+ *  helper rejects `other` deliberately so a close-but-wrong call does
+ *  not slip through). Excluding `add_context_rule` is the right
+ *  trade-off for now - it never blocks OZ smart-account recognition,
+ *  because the install tx always follows a recognised
+ *  `batch_add_signer` (the demo's first-pass tx), so the
+ *  contract still ends up in `knownContracts`. Updating the Arg type
+ *  vocabulary to cover these shapes is a separate concern (and would
+ *  also lift the SEP-41 / Blend recognition in the same change).
+ */
+export const OZ_ACCOUNT_ABI = {
+    batch_add_signer: {
+        args: [
+            {
+                name: 'context_rule_id',
+                type: 'u32',
+                meaning: 'OZ context rule id this signer is added to',
+            },
+            {
+                name: 'signers',
+                type: 'vec',
+                meaning: 'vec<SignerKey> signers to add (Delegated G-address or Account C-address)',
+            },
+        ],
+    },
+    batch_remove_signer: {
+        args: [
+            {
+                name: 'context_rule_id',
+                type: 'u32',
+                meaning: 'OZ context rule id to remove signers from',
+            },
+            {
+                name: 'signers',
+                type: 'vec',
+                meaning: 'vec<SignerKey> signers to remove from the rule',
+            },
+        ],
+    },
+    remove_context_rule: {
+        args: [
+            {
+                name: 'context_rule_id',
+                type: 'u32',
+                meaning: 'OZ context rule id to delete',
+            },
+        ],
+    },
+};
 export const PROTOCOL_ABIS = {
     sep41: SEP41_ABI,
     blend: BLEND_ABI,
     soroswap: SOROSWAP_ABI,
+    oz_account: OZ_ACCOUNT_ABI,
 };
 export function getAbi(protocol) {
     return PROTOCOL_ABIS[protocol];

package/dist/review-card/builder.d.ts

@@ -12,3 +12,16 @@ export interface ReviewCardSummary {
 /** Build a deterministic review-card summary from a policy + context rule +
  *  simulation result. Pure: same inputs -> byte-identical output. */
 export declare function buildReviewCardSummary(predicate: PredicateNode | null, policyRefs: PolicyRef[], contextRule: ContextRuleDraft, simulation: SimulationResult): ReviewCardSummary;
+/** Walk every comparison / membership node of the predicate and invoke
+ *  `visit` on each. The walk is depth-first, left-to-right, so the
+ *  constraint list is stable across runs. Pure boolean nodes contribute no
+ *  constraint lines themselves; their leaf children do, via the visitor. */
+/** Every constraint sentence for one predicate, in walk order.
+ *
+ *  `buildReviewCardSummary` renders a policy the synthesiser just PRODUCED,
+ *  and needs the refs / context rule / simulation to do it. This renders a
+ *  predicate on its own, which is what a caller holding a policy already
+ *  INSTALLED on chain has: it can read the document out of the interpreter's
+ *  storage and decode it, but there is no proposal around it. Same renderers,
+ *  so an installed rule reads exactly as it did on the review card. */
+export declare function describePredicate(predicate: PredicateNode): string[];

package/dist/review-card/builder.js

@@ -16,7 +16,7 @@
 //
 //   2. The interpreter `PredicateNode`. One string per constraint leaf,
 //      rendered by enclosing-comparison kind. Templates (Task 7b):
-//        - invocation_count_in_window <= N    -> Invocations <= N per <window> seconds
+//        - invocation_count_in_window < N     -> At most N calls per <window> seconds
 //        - call_arg[i] in [list]              -> Recipient/arg must be one of [list]
 //        - eq(call_arg[i], literal_vec[...])  -> Path must be exactly [list]
 //        - oracle_price(asset) OP price       -> Only when oracle_price(asset) OP price
@@ -81,6 +81,23 @@ function renderOzPrimitive(ref) {
  *  `visit` on each. The walk is depth-first, left-to-right, so the
  *  constraint list is stable across runs. Pure boolean nodes contribute no
  *  constraint lines themselves; their leaf children do, via the visitor. */
+/** Every constraint sentence for one predicate, in walk order.
+ *
+ *  `buildReviewCardSummary` renders a policy the synthesiser just PRODUCED,
+ *  and needs the refs / context rule / simulation to do it. This renders a
+ *  predicate on its own, which is what a caller holding a policy already
+ *  INSTALLED on chain has: it can read the document out of the interpreter's
+ *  storage and decode it, but there is no proposal around it. Same renderers,
+ *  so an installed rule reads exactly as it did on the review card. */
+export function describePredicate(predicate) {
+    const constraints = [];
+    walkPredicate(predicate, (node) => {
+        const line = renderConstraint(node);
+        if (line !== null)
+            constraints.push(line);
+    });
+    return constraints;
+}
 function walkPredicate(node, visit) {
     switch (node.op) {
         case 'and':
@@ -138,17 +155,50 @@ function renderComparison(node) {
     if (left.kind === 'call_arg' && node.op === 'eq' && right.kind === 'literal_vec') {
         return `Path must be exactly [${right.elements.map(renderVecElement).join(', ')}]`;
     }
-    // invocation_count_in_window <= N -> Invocations <= N per <window> seconds
+    // eq(call_arg_len[i], literal_u32) -> Length of arg[i] is K
+    // Binds the OUTER vec length so a caller cannot append an element to
+    // defeat a per-element pin. Rendered as a single readable line so the
+    // review card surfaces the implicit "no new elements" guarantee.
+    if (left.kind === 'call_arg_len' && node.op === 'eq' && right.kind === 'literal_u32') {
+        return `Length of arg[${left.index}] is ${right.value}`;
+    }
+    // eq/lte(call_arg_field[i, el, field], <literal>) -> arg[i] element[el].field = <value>
+    // The structured-argument bind pins a scalar field inside a vec element.
+    // For lt/gt/lte/gte the line reads "OP <value>" so the comparison kind
+    // is visible; eq reads "= <value>".
+    if (left.kind === 'call_arg_field') {
+        const head = `arg[${left.index}] element[${left.element}].${left.field}`;
+        const sep = node.op === 'eq' ? '=' : comparisonOpText(node.op);
+        if (right.kind === 'literal_address')
+            return `${head} ${sep} ${right.value}`;
+        if (right.kind === 'literal_symbol')
+            return `${head} ${sep} ${right.value}`;
+        if (right.kind === 'literal_bytes')
+            return `${head} ${sep} ${right.value}`;
+        if (right.kind === 'literal_u64')
+            return `${head} ${sep} ${right.value}`;
+        if (right.kind === 'literal_i128')
+            return `${head} ${sep} ${right.value}`;
+        if (right.kind === 'literal_u32')
+            return `${head} ${sep} ${right.value}`;
+        if (right.kind === 'literal_vec') {
+            return `${head} ${sep} [${right.elements.map(renderVecElement).join(', ')}]`;
+        }
+    }
+    // The bound is compared against the calls ALREADY made in the window, so
+    // `< N` permits N of them and `<= N` permits one more. Report how many
+    // calls the rule allows rather than restating the comparison.
     if (left.kind === 'invocation_count_in_window' && right.kind === 'literal_u32') {
-        return `Invocations <= ${right.value} per ${left.windowSecs} seconds`;
+        const allowed = node.op === 'lt' ? right.value : right.value + 1;
+        return `At most ${allowed} calls per ${left.windowSecs} seconds`;
     }
     // amount <= v -> Amount <= v
     if (left.kind === 'amount' && right.kind === 'literal_i128') {
         return `Amount <= ${right.value}`;
     }
     // oracle_price(asset) OP price -> Only when oracle_price(asset) OP price
-    if (left.kind === 'oracle_price' && right.kind === 'literal_i128') {
-        return `Only when oracle_price(${left.asset}) ${comparisonOpText(node.op)} ${right.value}`;
+    if (left.kind === 'oracle_price' && right.kind === 'oracle_threshold') {
+        return `Only when oracle_price(${left.asset}) ${comparisonOpText(node.op)} ${right.value} (${right.decimals} dp)`;
     }
     // Any other comparison shape is a structural fail-closed: do not surface
     // a misleading line. Cross-check still requires every leaf produce a
@@ -186,6 +236,7 @@ function renderVecElement(leaf) {
         case 'call_arg':
         case 'call_arg_len':
         case 'call_arg_field':
+        case 'call_arg_scaled':
         case 'amount':
         case 'window_spent':
         case 'now':
@@ -193,6 +244,11 @@ function renderVecElement(leaf) {
         case 'invocation_count_in_window':
         case 'oracle_price':
             return `<${leaf.kind}>`;
+        // Show the declared basis, not just the digits. A threshold on the wrong
+        // basis is the one policy error the contract cannot detect, so the review
+        // card is where a human has to be able to see it.
+        case 'oracle_threshold':
+            return `${leaf.value} (${leaf.decimals} dp)`;
     }
 }
 function renderHaystackElement(leaf) {

package/dist/review-card/cross-check.js

@@ -67,16 +67,57 @@ function pushComparison(left, right, op, out) {
         out.push(`Path must be exactly [${right.elements.map(renderVecElement).join(', ')}]`);
         return;
     }
+    if (left.kind === 'call_arg_len' && op === 'eq' && right.kind === 'literal_u32') {
+        out.push(`Length of arg[${left.index}] is ${right.value}`);
+        return;
+    }
+    // call_arg_field: must mirror the builder's templates byte-for-byte so
+    // the cross-check can assert a faithful summary.
+    if (left.kind === 'call_arg_field') {
+        const head = `arg[${left.index}] element[${left.element}].${left.field}`;
+        const sep = op === 'eq' ? '=' : comparisonOpText(op);
+        if (right.kind === 'literal_address') {
+            out.push(`${head} ${sep} ${right.value}`);
+            return;
+        }
+        if (right.kind === 'literal_symbol') {
+            out.push(`${head} ${sep} ${right.value}`);
+            return;
+        }
+        if (right.kind === 'literal_bytes') {
+            out.push(`${head} ${sep} ${right.value}`);
+            return;
+        }
+        if (right.kind === 'literal_u64') {
+            out.push(`${head} ${sep} ${right.value}`);
+            return;
+        }
+        if (right.kind === 'literal_i128') {
+            out.push(`${head} ${sep} ${right.value}`);
+            return;
+        }
+        if (right.kind === 'literal_u32') {
+            out.push(`${head} ${sep} ${right.value}`);
+            return;
+        }
+        if (right.kind === 'literal_vec') {
+            out.push(`${head} ${sep} [${right.elements.map(renderVecElement).join(', ')}]`);
+            return;
+        }
+    }
+    // Mirrors the builder's wording byte-for-byte: how many calls the rule
+    // permits, since the bound counts the calls already made.
     if (left.kind === 'invocation_count_in_window' && right.kind === 'literal_u32') {
-        out.push(`Invocations <= ${right.value} per ${left.windowSecs} seconds`);
+        const allowed = op === 'lt' ? right.value : right.value + 1;
+        out.push(`At most ${allowed} calls per ${left.windowSecs} seconds`);
         return;
     }
     if (left.kind === 'amount' && right.kind === 'literal_i128') {
         out.push(`Amount <= ${right.value}`);
         return;
     }
-    if (left.kind === 'oracle_price' && right.kind === 'literal_i128') {
-        out.push(`Only when oracle_price(${left.asset}) ${comparisonOpText(op)} ${right.value}`);
+    if (left.kind === 'oracle_price' && right.kind === 'oracle_threshold') {
+        out.push(`Only when oracle_price(${left.asset}) ${comparisonOpText(op)} ${right.value} (${right.decimals} dp)`);
         return;
     }
 }
@@ -107,6 +148,7 @@ function renderVecElement(leaf) {
         case 'call_arg':
         case 'call_arg_len':
         case 'call_arg_field':
+        case 'call_arg_scaled':
         case 'amount':
         case 'window_spent':
         case 'now':
@@ -114,6 +156,11 @@ function renderVecElement(leaf) {
         case 'invocation_count_in_window':
         case 'oracle_price':
             return `<${leaf.kind}>`;
+        // Show the declared basis, not just the digits. A threshold on the wrong
+        // basis is the one policy error the contract cannot detect, so the review
+        // card is where a human has to be able to see it.
+        case 'oracle_threshold':
+            return `${leaf.value} (${leaf.decimals} dp)`;
     }
 }
 function renderHaystackElement(leaf) {

package/dist/review-card/index.d.ts

@@ -1,3 +1,3 @@
-export { buildReviewCardSummary, type ReviewCardSummary, } from './builder.ts';
+export { buildReviewCardSummary, describePredicate, type ReviewCardSummary, } from './builder.ts';
 export { type ConflictAnnotation, classifyConflict, type RuleRef, } from './conflict.ts';
 export { summaryCrossCheck } from './cross-check.ts';

package/dist/review-card/index.js

@@ -1,4 +1,4 @@
 // src/review-card/index.ts - re-export the deterministic review-card surface.
-export { buildReviewCardSummary, } from "./builder.js";
+export { buildReviewCardSummary, describePredicate, } from "./builder.js";
 export { classifyConflict, } from "./conflict.js";
 export { summaryCrossCheck } from "./cross-check.js";

package/dist/run/index.d.ts

@@ -1,4 +1,5 @@
-import { type ErrorCode, type ProposedPolicy, type RecordedTransaction, type ToolError, type ToolResponse } from '../index.ts';
+import { type ErrorCode, type PredicateNode, type ProposedPolicy, type RecordedTransaction, type ToolError, type ToolResponse } from '../index.ts';
+import type { SimulationResult } from '../verify/envelope.ts';
 import { type RecordTransactionInput, type SynthesizePolicyInput } from './schemas.ts';
 export type { RecordTransactionInput, SynthesizePolicyInput } from './schemas.ts';
 export { ComposeUserResponsesSchema, InterpreterOptionsSchema, MandateSpecSchema, NetworkSchema, OzAdapterConfigSchema, RecordedTransactionSchema, RecordTransactionInputSchema, SynthesizePolicyInputSchema, ToolErrorSchema, } from './schemas.ts';
@@ -28,7 +29,12 @@ export declare function runRecordTransaction(raw: unknown): Promise<ToolResponse
  *  `{ok:false, error}`, but a raw throw from the SDK (e.g. an unexpected
  *  XDR decode error in the adapter) would otherwise surface as
  *  "[object Object]" in the MCP transport. */
-export declare function runSynthesizePolicy(raw: unknown): Promise<ToolResponse<ProposedPolicy>>;
+export declare function runSynthesizePolicy(raw: unknown): Promise<ToolResponse<ProposedPolicy> & {
+    explain?: {
+        predicateTree: PredicateNode | null;
+        simulation: SimulationResult;
+    };
+}>;
 /** Build a canonical ToolError for a thrown exception caught by the tool
  *  envelope. The MCP SDK stringifies thrown objects as "[object Object]" by
  *  default, so we extract a string-friendly message and tag the original

package/dist/run/index.js

@@ -89,7 +89,7 @@ export async function runSynthesizePolicy(raw) {
             // Zod's optional fields widen to `T | undefined`, which the core's
             // exact-optional MandateSpec rejects; the schema already validated the
             // shape, so assert it (same pattern as the recordedTx cast below).
-            return await synthesizeFromMandate(input.mandate, ozConfig);
+            return await synthesizeFromMandate(input.mandate, ozConfig, input.explain === true ? { explain: true } : {});
         }
         // recording source
         const recorded = input.recordedTx;
@@ -100,6 +100,7 @@ export async function runSynthesizePolicy(raw) {
                 ? { confidenceOverride: input.confidenceOverride }
                 : {}),
             ...(input.interpreter !== undefined ? { interpreter: input.interpreter } : {}),
+            ...(input.explain === true ? { explain: true } : {}),
         }, ozConfig);
     }
     catch (e) {

package/dist/run/schemas.d.ts

@@ -648,6 +648,7 @@ export declare const SynthesizePolicyMandateInputSchema: z.ZodObject<{
             weighted_threshold: string;
         };
     }>>;
+    explain: z.ZodOptional<z.ZodBoolean>;
 }, "strip", z.ZodTypeAny, {
     source: "mandate";
     mandate: {
@@ -676,6 +677,7 @@ export declare const SynthesizePolicyMandateInputSchema: z.ZodObject<{
             weighted_threshold: string;
         };
     } | undefined;
+    explain?: boolean | undefined;
 }, {
     source: "mandate";
     mandate: {
@@ -704,6 +706,7 @@ export declare const SynthesizePolicyMandateInputSchema: z.ZodObject<{
             weighted_threshold: string;
         };
     } | undefined;
+    explain?: boolean | undefined;
 }>;
 /** Interpreter opt-in for the recording path. Present -> constraints OZ cannot
  *  express (per-method scoping, invocation-count windows, oracle bounds, exact
@@ -1085,17 +1088,18 @@ export declare const SynthesizePolicyRecordingInputSchema: z.ZodObject<{
             weighted_threshold: string;
         };
     }>>;
+    explain: z.ZodOptional<z.ZodBoolean>;
 }, "strip", z.ZodTypeAny, {
     network: "mainnet" | "testnet";
     source: "recording";
     recordedTx: {
+        signers: string[];
         events: {
             contract: string;
             topics: string[];
             data?: unknown;
         }[];
         network: "mainnet" | "testnet";
-        signers: string[];
         invocations: unknown[];
         tokenMovements: {
             amount: string;
@@ -1149,17 +1153,18 @@ export declare const SynthesizePolicyRecordingInputSchema: z.ZodObject<{
             weighted_threshold: string;
         };
     } | undefined;
+    explain?: boolean | undefined;
 }, {
     network: "mainnet" | "testnet";
     source: "recording";
     recordedTx: {
+        signers: string[];
         events: {
             contract: string;
             topics: string[];
             data?: unknown;
         }[];
         network: "mainnet" | "testnet";
-        signers: string[];
         invocations: unknown[];
         tokenMovements: {
             amount: string;
@@ -1213,6 +1218,7 @@ export declare const SynthesizePolicyRecordingInputSchema: z.ZodObject<{
             weighted_threshold: string;
         };
     } | undefined;
+    explain?: boolean | undefined;
 }>;
 export declare const SynthesizePolicyInputSchema: z.ZodDiscriminatedUnion<"source", [z.ZodObject<{
     source: z.ZodLiteral<"mandate">;
@@ -1334,6 +1340,7 @@ export declare const SynthesizePolicyInputSchema: z.ZodDiscriminatedUnion<"sourc
             weighted_threshold: string;
         };
     }>>;
+    explain: z.ZodOptional<z.ZodBoolean>;
 }, "strip", z.ZodTypeAny, {
     source: "mandate";
     mandate: {
@@ -1362,6 +1369,7 @@ export declare const SynthesizePolicyInputSchema: z.ZodDiscriminatedUnion<"sourc
             weighted_threshold: string;
         };
     } | undefined;
+    explain?: boolean | undefined;
 }, {
     source: "mandate";
     mandate: {
@@ -1390,6 +1398,7 @@ export declare const SynthesizePolicyInputSchema: z.ZodDiscriminatedUnion<"sourc
             weighted_threshold: string;
         };
     } | undefined;
+    explain?: boolean | undefined;
 }>, z.ZodObject<{
     source: z.ZodLiteral<"recording">;
     recordedTx: z.ZodObject<{
@@ -1736,17 +1745,18 @@ export declare const SynthesizePolicyInputSchema: z.ZodDiscriminatedUnion<"sourc
             weighted_threshold: string;
         };
     }>>;
+    explain: z.ZodOptional<z.ZodBoolean>;
 }, "strip", z.ZodTypeAny, {
     network: "mainnet" | "testnet";
     source: "recording";
     recordedTx: {
+        signers: string[];
         events: {
             contract: string;
             topics: string[];
             data?: unknown;
         }[];
         network: "mainnet" | "testnet";
-        signers: string[];
         invocations: unknown[];
         tokenMovements: {
             amount: string;
@@ -1800,17 +1810,18 @@ export declare const SynthesizePolicyInputSchema: z.ZodDiscriminatedUnion<"sourc
             weighted_threshold: string;
         };
     } | undefined;
+    explain?: boolean | undefined;
 }, {
     network: "mainnet" | "testnet";
     source: "recording";
     recordedTx: {
+        signers: string[];
         events: {
             contract: string;
             topics: string[];
             data?: unknown;
         }[];
         network: "mainnet" | "testnet";
-        signers: string[];
         invocations: unknown[];
         tokenMovements: {
             amount: string;
@@ -1864,6 +1875,7 @@ export declare const SynthesizePolicyInputSchema: z.ZodDiscriminatedUnion<"sourc
             weighted_threshold: string;
         };
     } | undefined;
+    explain?: boolean | undefined;
 }>]>;
 export type SynthesizePolicyInput = z.infer<typeof SynthesizePolicyInputSchema>;
 export declare const ToolErrorSchema: z.ZodObject<{

package/dist/run/schemas.js

@@ -175,6 +175,11 @@ export const SynthesizePolicyMandateInputSchema = z.object({
     source: z.literal('mandate'),
     mandate: MandateSpecSchema,
     ozConfig: OzAdapterConfigSchema.optional(),
+    // --explain opt-in. When true, the orchestrator attaches the
+    // in-memory predicate tree (null for the mandate path) + a minimal
+    // honest SimulationResult to the success envelope. Absent or false
+    // -> the success envelope is unchanged (byte-identical to today).
+    explain: z.boolean().optional(),
 });
 /** Interpreter opt-in for the recording path. Present -> constraints OZ cannot
  *  express (per-method scoping, invocation-count windows, oracle bounds, exact
@@ -200,6 +205,15 @@ export const SynthesizePolicyRecordingInputSchema = z.object({
     confidenceOverride: z.object({ threshold: z.number().min(0).max(1) }).optional(),
     interpreter: InterpreterOptionsSchema.optional(),
     ozConfig: OzAdapterConfigSchema.optional(),
+    // --explain opt-in. When true, the orchestrator attaches the
+    // in-memory PredicateNode + the corresponding SimulationResult
+    // (real one from the self-verify pipeline when the interpreter is
+    // engaged, minimal honest value otherwise) to the success envelope.
+    // Absent or false -> the success envelope is unchanged (byte-identical
+    // to today). The flag is ADDITIVE: the existing ProposedPolicy fields
+    // (encodedPredicate, predicateHash, etc.) are never altered by enabling
+    // explain.
+    explain: z.boolean().optional(),
 });
 export const SynthesizePolicyInputSchema = z.discriminatedUnion('source', [
     SynthesizePolicyMandateInputSchema,

package/dist/synth/compose-from-recording.d.ts

@@ -8,6 +8,10 @@ export interface OraclePriceBound {
     asset: string;
     operator: IRCompOp;
     value: string;
+    /** Decimal basis `value` is written on. REQUIRED: oracle prices normalise to
+     *  9 dp, and a threshold silently assumed to share that basis is what let a
+     *  raw 14-dp bound permit everything. The author states it; we convert. */
+    decimals: number;
 }
 /** Caller-supplied answers to the ambiguity prompts. Every numeric bound the
  *  synth might apply must come from here - the recording supplies observed

package/dist/synth/compose-from-recording.js

@@ -105,11 +105,17 @@ export function composeFromRecording(facts, scopeContract, topLevel, opts) {
                         value: limit,
                     },
                 };
-                if (!interpreterEnabled || token === scopeContract) {
-                    ozConstraints.push(spendCond);
-                }
-                else {
-                    interpreterConstraints.push(spendCond);
+                // A rolling spend cap always goes to OZ, whose `spending_limit` is the
+                // audited implementation. The interpreter is NOT a fallback for the
+                // token != scopeContract case: on chain it sees one authorized call,
+                // not the transaction's token movements, so it has no per-call amount
+                // to accumulate and the counter would never move. OZ reports the case
+                // it cannot cover (it pins the limit to the context contract), which
+                // is the honest outcome - the old fallback produced an interpreter
+                // predicate that silently never bound.
+                ozConstraints.push(spendCond);
+                if (interpreterEnabled && token !== scopeContract) {
+                    warnings.push(`rolling spend cap on ${token} cannot be enforced on chain: OZ spending_limit pins the limit to the context contract, and the interpreter cannot observe token movements. Bound the per-call value with an argument cap plus an invocation-count limit instead.`);
                 }
             }
         }
@@ -134,7 +140,10 @@ export function composeFromRecording(facts, scopeContract, topLevel, opts) {
                 op: 'compare',
                 compare: {
                     selector: { kind: 'invocation_count', windowSeconds },
-                    operator: 'lte',
+                    // `lt`, not `lte`: the leaf reports the calls ALREADY made in the
+                    // window, so `< N` is what permits N of them. With `lte` a limit
+                    // of N let an N+1th call through.
+                    operator: 'lt',
                     value: String(invocationLimit),
                 },
             };
@@ -165,6 +174,7 @@ export function composeFromRecording(facts, scopeContract, topLevel, opts) {
                     selector: { kind: 'oracle_price', asset: b.asset },
                     operator: b.operator,
                     value: b.value,
+                    valueDecimals: b.decimals,
                 },
             };
             if (interpreterEnabled) {
@@ -300,8 +310,15 @@ function appendProtocolSpecificConstraints(ozConstraints, interpreterConstraints
             });
             for (let i = 0; i < elements.length; i++) {
                 const element = elements[i];
-                if (!element || element.type !== 'map')
+                // An element we cannot bind leaves that request's action, asset and
+                // amount free while the length pin makes the policy LOOK total. The
+                // length pin still stays (it is a real restriction, and dropping it
+                // would only widen the policy) - what must not happen is dropping the
+                // element quietly.
+                if (element?.type !== 'map') {
+                    warnings.push(`Blend submit requests element ${i} is not a Request map (recorded as ${element?.type ?? 'nothing'}): its request_type, address and amount are NOT pinned, so any action on any asset for any amount is permitted in that position`);
                     continue;
+                }
                 const fields = element.value;
                 const fieldValue = (name, scalarType) => {
                     const entry = fields.find((e) => e.key === name);
@@ -318,8 +335,17 @@ function appendProtocolSpecificConstraints(ozConstraints, interpreterConstraints
                 const address = fieldValue('address', 'address');
                 const amount = fieldValue('amount', 'i128');
                 const requestType = fieldValue('request_type', 'u32');
-                if (address === null || amount === null || requestType === null)
+                if (address === null || amount === null || requestType === null) {
+                    const missing = [
+                        requestType === null ? 'request_type (u32)' : null,
+                        address === null ? 'address' : null,
+                        amount === null ? 'amount (i128)' : null,
+                    ].filter((f) => f !== null);
+                    // Partial pins are deliberately NOT emitted (see the note above): a
+                    // half-pinned request reads as a bound one on the review card.
+                    warnings.push(`Blend submit requests element ${i} could not be bound: ${missing.join(', ')} missing or of an unexpected type. That request's request_type, address and amount are NOT pinned, so any action on any asset for any amount is permitted in that position`);
                     continue;
+                }
                 interpreterConstraints.push({
                     op: 'compare',
                     compare: {

package/dist/synth/deny-cases.d.ts

@@ -1,4 +1,4 @@
-import type { PredicateNode } from '../types.ts';
+import type { PredicateNode, ScVal } from '../types.ts';
 import type { EvalContext } from './evaluate.ts';
 export interface DenyCase {
     dimension: string;
@@ -20,3 +20,6 @@ export { ORIGINAL_DIMENSIONS, OVERPERMISSIVE_DIMENSIONS };
  *                     are emitted. The synth pipeline passes ORIGINAL_DIMENSIONS so
  *                     existing fixtures do not regress. */
 export declare function generateCases(predicate: PredicateNode, permitCtx: EvalContext, dimensions?: string[]): GeneratedCases;
+/** Deep-copy an ScVal so a mutation cannot alias the recorded call.
+ *  Exported so the permit-context builder shares this one implementation. */
+export declare function cloneScVal(value: ScVal, depth?: number): ScVal;

package/dist/synth/deny-cases.js

@@ -476,7 +476,9 @@ function cloneContext(ctx) {
         cloned.signerWeights = { ...ctx.signerWeights };
     return cloned;
 }
-function cloneScVal(value, depth = 0) {
+/** Deep-copy an ScVal so a mutation cannot alias the recorded call.
+ *  Exported so the permit-context builder shares this one implementation. */
+export function cloneScVal(value, depth = 0) {
     // Recursion is bounded by MAX_SCVAL_CLONE_DEPTH so a hand-crafted nested-vec
     // payload cannot RangeError the JS stack during deny-case mutation. Over-depth
     // throws a ToolError-shaped error that the `synthesizeFromRecording` envelope