@crediolabs/policy-synth 0.2.0 → 0.3.0

package/dist-cjs/predicate/encode.js

@@ -3,7 +3,7 @@
 //
 // Pure function. Maps a `PredicateNode` AST to the canonical ScVal wire format:
 //   - every node is a `ScVal::Vec` whose head element is the tag `ScVal::Symbol`
-//   - children of `and` / `or` are sorted ascending by their canonical XDR bytes
+//   - children of `and` are sorted ascending by their canonical XDR bytes
 //   - `in` haystacks are ALWAYS sorted by canonical XDR bytes (pure set
 //     membership); an EXACT ordered sequence is expressed as
 //     `eq(selector, literal_vec)` where the `literal_vec` element order is
@@ -18,12 +18,6 @@
 // Caps from `PREDICATE_CAPS` are enforced BEFORE returning; a cap breach throws
 // a `ToolError` with the matching error code and `severity: 'error'`.
 //
-// One gap remains, deliberately: the `amount` / `window_spent` leaf branches
-// below are dead ABI - the contract's grammar no longer has those selector
-// symbols, so a predicate carrying one is MALFORMED at decode. The interpreter
-// adapter reports them as uncovered before lowering, so the product path
-// cannot emit one; removing the branches (and the leaf kinds) is a separate
-// change.
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.encodePredicate = encodePredicate;
 const node_crypto_1 = require("node:crypto");
@@ -48,27 +42,22 @@ function encodePredicate(node) {
             throw capError('IN_OPERAND_LIMIT', `\`in\` operand count ${c.count} exceeds MAX_IN_OPERAND_COUNT ${types_ts_1.PREDICATE_CAPS.MAX_IN_OPERAND_COUNT}`);
         }
     }
-    // Two-round confirmation costs 2 oracle reads per UNIQUE asset referenced.
-    const oracleReads = stats.oracleAssets.size * 2;
-    if (oracleReads > types_ts_1.PREDICATE_CAPS.MAX_ORACLE_READS) {
-        throw capError('PREDICATE_ORACLE_OVER_LIMIT', `oracle reads ${oracleReads} exceed MAX_ORACLE_READS ${types_ts_1.PREDICATE_CAPS.MAX_ORACLE_READS}`);
+    // Minimum constraint. A predicate with no selector leaf compares literals
+    // to literals, so it is trivially true or false and would permit everything
+    // or nothing forever. The contract refuses it at install with
+    // SELECTOR_LEAF_REQUIRED (216); refuse it here too so the failure is caught
+    // before a transaction is built.
+    if (stats.selectorLeaves === 0) {
+        throw capError('MALFORMED_PREDICATE', 'predicate constrains nothing: every comparison has literals on both sides. The contract refuses it at install (SELECTOR_LEAF_REQUIRED). Pin the call itself - contract, method or argument.');
     }
-    if (stats.oracleAssets.size > 0 && stats.nonOracleSelectorLeaves === 0) {
-        throw capError('MALFORMED_PREDICATE', 'predicate constrains nothing but an oracle price: the contract refuses it at install (dsl.rs MissingNonOracleEnvelope). Pin the call itself (contract / method / argument) alongside the price bound.');
-    }
-    // --- pass 1.5: leaf-value validation (Rust `validate_scaled_ratios` + the
-    // broader cap-set gate the contract enforces at install). Defense in depth:
-    // the TS self-verify pipeline should reject the same shapes Rust install
-    // refuses, so a hand-crafted predicate that simulate/verify green-lights
-    // cannot later be refused at the on-chain install step. The checks:
-    //   - u32 fields in range (call_arg index, literal_u32 value, oracle
-    //     threshold decimals, etc.) - the contract decodes as u32
-    //   - i128 positivity where required (literal_i128 for amount/window
-    //     caps; `den`/`num` for scaled ratios) - a negative cap would
-    //     permit everything
-    //   - hex even-length (literal_bytes) - `Buffer.from(v, 'hex')` silently
-    //     drops non-hex chars, so 'zz' becomes empty bytes
-    //   - scaled-ratio num>0 && den>0 - mirrors dsl.rs:661-704
+    // --- pass 1.5: leaf-value validation against the cap-set gate the contract
+    // enforces at install. Defense in depth: the TS self-verify pipeline should
+    // reject the same shapes Rust install refuses, so a hand-crafted predicate
+    // that simulate/verify green-lights cannot later be refused at the on-chain
+    // install step. The checks are the u32 ranges on the argument selectors
+    // (`call_arg.index`, `call_arg_len.index`, `call_arg_field.index` and
+    // `.element`) - the contract decodes each as u32, so an out-of-range value
+    // would fail there instead.
     // Throws `MALFORMED_PREDICATE` so the error stays a ToolError shape.
     validateLeafValues(node);
     // --- pass 2: build + canonicalise the ScVal ---
@@ -83,48 +72,35 @@ function encodePredicate(node) {
 }
 function computeStats(node) {
     const inCounts = [];
-    const oracleAssets = new Set();
-    const counters = { nonOracleSelectorLeaves: 0 };
-    const { depth, leaves } = walk(node, inCounts, oracleAssets, counters, false);
+    const counters = { selectorLeaves: 0 };
+    const { depth, leaves } = walk(node, inCounts, counters);
     return {
         depth,
         leaves,
         inCounts,
-        oracleAssets,
-        nonOracleSelectorLeaves: counters.nonOracleSelectorLeaves,
+        selectorLeaves: counters.selectorLeaves,
     };
 }
-function walk(node, inCounts, oracleAssets, counters, 
-/** True once the walk is under a `not` or an `or`, where an oracle read
- *  becomes a condition the caller can satisfy by taking the other branch. */
-negatedOrDisjunctive) {
+function walk(node, inCounts, counters) {
     switch (node.op) {
-        case 'and':
-        case 'or': {
+        case 'and': {
             if (node.children.length === 0) {
                 throw capError('MALFORMED_PREDICATE', `\`${node.op}\` with no children: the contract refuses it at decode (MALFORMED_PREDICATE), so it can never be installed`);
             }
             let maxChildDepth = 0;
             let totalLeaves = 0;
             for (const c of node.children) {
-                const child = walk(c, inCounts, oracleAssets, counters, negatedOrDisjunctive || node.op === 'or');
+                const child = walk(c, inCounts, counters);
                 if (child.depth > maxChildDepth)
                     maxChildDepth = child.depth;
                 totalLeaves += child.leaves;
             }
             return { depth: maxChildDepth + 1, leaves: totalLeaves };
         }
-        case 'not': {
-            const child = walk(node.child, inCounts, oracleAssets, counters, true);
-            return { depth: child.depth + 1, leaves: child.leaves };
-        }
         case 'eq':
-        case 'lt':
-        case 'lte':
-        case 'gt':
-        case 'gte': {
-            collectOracle(node.left, oracleAssets, counters, negatedOrDisjunctive);
-            collectOracle(node.right, oracleAssets, counters, negatedOrDisjunctive);
+        case 'lte': {
+            collectSelector(node.left, counters);
+            collectSelector(node.right, counters);
             return { depth: 1, leaves: leafCount(node.left) + leafCount(node.right) };
         }
         case 'in': {
@@ -132,10 +108,10 @@ negatedOrDisjunctive) {
                 throw capError('MALFORMED_PREDICATE', '`in` with an empty haystack: the contract refuses it at decode (MALFORMED_PREDICATE), so it can never be installed');
             }
             inCounts.push({ count: node.haystack.length });
-            collectOracle(node.needle, oracleAssets, counters, negatedOrDisjunctive);
+            collectSelector(node.needle, counters);
             let haystackLeaves = 0;
             for (const h of node.haystack) {
-                collectOracle(h, oracleAssets, counters, negatedOrDisjunctive);
+                collectSelector(h, counters);
                 haystackLeaves += leafCount(h);
             }
             return {
@@ -157,45 +133,27 @@ function leafCount(leaf) {
     }
     return 1;
 }
-function collectOracle(leaf, oracleAssets, counters, negatedOrDisjunctive) {
-    // literal_vec is the only nested leaf; recurse so an oracle_price buried in a
-    // vector literal (which the lowering would forbid, but the cap-walker must
-    // still see) is counted toward the oracle-read budget.
-    if (leaf.kind === 'oracle_price') {
-        if (negatedOrDisjunctive) {
-            throw capError('ORACLE_LEAF_INVALID_POSITION', `oracle_price(${leaf.asset}) sits under a \`not\`/\`or\`: the contract refuses that position at install (dsl.rs validate_oracle_placement). An oracle bound must be a conjunct the call has to satisfy.`);
-        }
-        oracleAssets.add(leaf.asset);
-    }
-    else if (leaf.kind === 'literal_vec') {
+function collectSelector(leaf, counters) {
+    // literal_vec is the only nested leaf; recurse so a selector buried in a
+    // vector literal is still counted. Mirrors `dsl::has_selector_leaf`.
+    if (leaf.kind === 'literal_vec') {
         for (const el of leaf.elements)
-            collectOracle(el, oracleAssets, counters, negatedOrDisjunctive);
+            collectSelector(el, counters);
     }
-    else if (!leaf.kind.startsWith('literal_') && leaf.kind !== 'oracle_threshold') {
-        // A threshold is the oracle compare's operand, not an independent
-        // constraint. Counting it would let an oracle-only predicate satisfy the
-        // non-oracle envelope with its own bound (mirrors collect_oracle_leaf in
-        // dsl.rs, where it sits with the literals).
-        counters.nonOracleSelectorLeaves += 1;
+    else if (!leaf.kind.startsWith('literal_')) {
+        counters.selectorLeaves += 1;
     }
 }
 function encodeNode(node) {
     switch (node.op) {
-        case 'and':
-        case 'or': {
+        case 'and': {
             const encoded = node.children.map(encodeNode);
             // sort children by their canonical XDR bytes ascending.
             const sorted = sortByCanonicalBytes(encoded);
             return stellar_sdk_1.xdr.ScVal.scvVec([symbol(node.op), stellar_sdk_1.xdr.ScVal.scvVec(sorted)]);
         }
-        case 'not': {
-            return stellar_sdk_1.xdr.ScVal.scvVec([symbol('not'), encodeNode(node.child)]);
-        }
         case 'eq':
-        case 'lt':
-        case 'lte':
-        case 'gt':
-        case 'gte': {
+        case 'lte': {
             return stellar_sdk_1.xdr.ScVal.scvVec([symbol(node.op), encodeLeaf(node.left), encodeLeaf(node.right)]);
         }
         case 'in': {
@@ -226,47 +184,6 @@ function encodeLeaf(leaf) {
                 stellar_sdk_1.xdr.ScVal.scvU32(leaf.element),
                 stellar_sdk_1.xdr.ScVal.scvSymbol(leaf.field),
             ]);
-        case 'call_arg_scaled':
-            // Wire shape `vec[symbol, u32, i128, i128]` mirrors the Rust decoder's
-            // expectation in dsl.rs SEL_CALL_ARG_SCALED. `scvI128FromDecimal` is
-            // the same range-checked helper used by `literal_i128`; an out-of-range
-            // num/den is refused at encode time (rather than at install on chain).
-            return stellar_sdk_1.xdr.ScVal.scvVec([
-                symbol('call_arg_scaled'),
-                stellar_sdk_1.xdr.ScVal.scvU32(leaf.index),
-                scvI128FromDecimal(leaf.num),
-                scvI128FromDecimal(leaf.den),
-            ]);
-        case 'amount':
-            return stellar_sdk_1.xdr.ScVal.scvVec([symbol('amount'), scvAddressFromStrkey(leaf.token)]);
-        case 'window_spent':
-            return stellar_sdk_1.xdr.ScVal.scvVec([
-                symbol('window_spent'),
-                scvAddressFromStrkey(leaf.token),
-                scvU64FromValue(leaf.windowSeconds),
-            ]);
-        case 'now':
-            return stellar_sdk_1.xdr.ScVal.scvVec([symbol('now')]);
-        case 'valid_until':
-            // The interpreter refuses this leaf at install: it never sources
-            // valid_until_ledger, so a policy built on it would deny forever.
-            // Expiry belongs to the smart account, through the context rule's
-            // validUntilLedger. Refuse at synthesis so the author finds out here
-            // rather than from an install that always fails.
-            throw new Error('valid_until is not a usable predicate leaf: the interpreter never sources it and ' +
-                'refuses it at install. Put expiry on the context rule (validUntilLedger) instead.');
-        case 'invocation_count_in_window':
-            return stellar_sdk_1.xdr.ScVal.scvVec([symbol('invocation_count'), scvU64FromValue(leaf.windowSecs)]);
-        case 'oracle_price':
-            return stellar_sdk_1.xdr.ScVal.scvVec([symbol('oracle_price'), scvAddressFromStrkey(leaf.asset)]);
-        case 'oracle_threshold':
-            // Arity 3, matching SEL_ORACLE_THRESHOLD in dsl.rs. The declared basis
-            // travels with the value so the contract never has to assume one.
-            return stellar_sdk_1.xdr.ScVal.scvVec([
-                symbol('oracle_threshold'),
-                scvI128FromDecimal(leaf.value),
-                stellar_sdk_1.xdr.ScVal.scvU32(leaf.decimals),
-            ]);
         case 'literal_address':
             return scvAddressFromStrkey(leaf.value);
         case 'literal_i128':
@@ -275,10 +192,6 @@ function encodeLeaf(leaf) {
             return stellar_sdk_1.xdr.ScVal.scvSymbol(leaf.value);
         case 'literal_u32':
             return stellar_sdk_1.xdr.ScVal.scvU32(leaf.value);
-        case 'literal_u64':
-            return scvU64FromValue(leaf.value);
-        case 'literal_bytes':
-            return stellar_sdk_1.xdr.ScVal.scvBytes(Buffer.from(leaf.value, 'hex'));
         case 'literal_vec':
             // Bare ScVal::Vec of element encodings - order is preserved verbatim
             // because the order IS the semantic (exact ordered sequence equality).
@@ -296,11 +209,6 @@ function sortByCanonicalBytes(values) {
 function scvAddressFromStrkey(strkey) {
     return stellar_sdk_1.xdr.ScVal.scvAddress(stellar_sdk_1.Address.fromString(strkey).toScAddress());
 }
-function scvU64FromValue(value) {
-    // The Uint64 (UnsignedHyper) constructor accepts string | bigint | number;
-    // string is safest for values > 2^53.
-    return stellar_sdk_1.xdr.ScVal.scvU64(new stellar_sdk_1.xdr.Uint64(String(value)));
-}
 /** Build `ScVal::I128(Int128Parts{hi, lo})` from a signed decimal string.
  *  `Int128Parts` encodes the value as `(hi << 64) + lo` with `hi` a SIGNED
  *  64-bit int and `lo` an UNSIGNED 64-bit int (this is NOT signed-magnitude).
@@ -316,9 +224,8 @@ function scvI128FromDecimal(decimal) {
     if (hi < INT64_MIN || hi > INT64_MAX) {
         throw capError('MALFORMED_PREDICATE', `literal_i128 value ${decimal} is outside the Int128 range`);
     }
-    if (lo < 0n || lo > UINT64_MAX) {
-        throw capError('MALFORMED_PREDICATE', `literal_i128 value ${decimal} has an invalid Int128Parts.lo`);
-    }
+    // `lo` needs no range check: masking with UINT64_MAX puts it in
+    // [0, 2^64-1] for every v, negative included.
     return stellar_sdk_1.xdr.ScVal.scvI128(new stellar_sdk_1.xdr.Int128Parts({
         hi: new stellar_sdk_1.xdr.Int64(hi),
         lo: new stellar_sdk_1.xdr.Uint64(lo),
@@ -334,19 +241,13 @@ function capError(code, message) {
 // u32 boundary - the same constant the contract decodes with. A value above
 // this either overflows during encode or is refused at install.
 const U32_MAX = 4294967295;
-// The maximum decimal basis an oracle threshold can declare (mirrors
-// `MAX_ORACLE_THRESHOLD_DECIMALS` in dsl.rs). A value above this is refused
-// at install with `ORACLE_PARAMS_OUT_OF_RANGE`.
-const MAX_ORACLE_THRESHOLD_DECIMALS = 18;
-/** Walk a `PredicateNode` and fail-closed on any leaf whose cap-set value the
- *  contract would refuse at install. Mirrors `validate_scaled_ratios` in
- *  dsl.rs:661-704 plus the broader cap-set gate (`literal_u32`, `literal_i128`
- *  positivity, `literal_bytes` hex even-length, `oracle_threshold` decimals
- *  range, `call_arg_scaled` positive-ratio). Defense in depth so the TS
- *  self-verify pipeline rejects the same shapes Rust install already
- *  refuses - a hand-crafted predicate that simulate/verify green-lights must
- *  NOT be installable. Throws `MALFORMED_PREDICATE` so the envelope shapes
- *  it into a ToolError. */
+/** Walk a `PredicateNode` and fail-closed on any leaf whose value the contract
+ *  would refuse at install: the argument selectors carry u32 indices, so a
+ *  value outside that range is refused here rather than on chain. Defense in
+ *  depth so the TS self-verify pipeline rejects the same shapes Rust install
+ *  already refuses - a hand-crafted predicate that simulate/verify
+ *  green-lights must NOT be installable. Throws `MALFORMED_PREDICATE` so the
+ *  envelope shapes it into a ToolError. */
 function validateLeafValues(node) {
     function walkLeaf(leaf, path) {
         switch (leaf.kind) {
@@ -368,107 +269,22 @@ function validateLeafValues(node) {
                     throw malformed(`call_arg_field.element out of u32 range at ${path}`);
                 }
                 return;
-            case 'call_arg_scaled': {
-                if (!Number.isInteger(leaf.index) || leaf.index < 0 || leaf.index > U32_MAX) {
-                    throw malformed(`call_arg_scaled.index out of u32 range at ${path}`);
-                }
-                // num / den are i128 on chain, decimal strings on the wire. The
-                // contract refuses `den == 0` and `num <= 0` / `den <= 0` at install
-                // (dsl.rs:664-672); mirror that here so a future regression in
-                // `validate_scaled_ratios` cannot let a divide-by-zero policy reach
-                // the wire. BigInt throws on non-numeric strings -> malformed.
-                let num;
-                let den;
-                try {
-                    num = BigInt(leaf.num);
-                    den = BigInt(leaf.den);
-                }
-                catch {
-                    throw malformed(`call_arg_scaled.num/den not a decimal integer at ${path}`);
-                }
-                if (num <= 0n)
-                    throw malformed(`call_arg_scaled.num must be > 0 at ${path}`);
-                if (den <= 0n)
-                    throw malformed(`call_arg_scaled.den must be > 0 at ${path}`);
-                return;
-            }
-            case 'literal_u32':
-                if (!Number.isInteger(leaf.value) || leaf.value < 0 || leaf.value > U32_MAX) {
-                    throw malformed(`literal_u32.value out of u32 range at ${path}`);
-                }
-                return;
-            case 'literal_i128':
-                // literal_i128 is signed; the contract allows negatives (i128
-                // arithmetic), but caps on a positive quantity (amount / window
-                // bound) should never be negative - a negative cap is silently
-                // satisfied by every non-negative amount. The contract gate is
-                // already on the leaf's ROLE (amount vs equality) not the value;
-                // here we mirror the value-only invariant the cap-set gate enforces
-                // by refusing the syntactic shape that would clearly be a bug
-                // (literal_i128 as a CAP with a leading `-` on a non-equality).
-                // We do not gate equality i128 - `literal_i128` as an address-by-
-                // equality is fine (it is just a constant).
-                // The value itself is always accepted; the structural check
-                // (non-negative for an amount / window bound) is left to the
-                // caller-built predicate, not the encoder.
-                return;
-            case 'literal_bytes':
-                // Hex even-length: a non-hex char silently drops, and an odd
-                // length yields a half-byte Buffer. The contract decodes with a
-                // strict hex parser and refuses anything that is not even-length
-                // hex; mirror that here.
-                if (!/^[0-9a-fA-F]*$/.test(leaf.value) || leaf.value.length % 2 !== 0) {
-                    throw malformed(`literal_bytes.value must be even-length hex at ${path}`);
-                }
-                return;
-            case 'oracle_threshold':
-                if (!Number.isInteger(leaf.decimals) ||
-                    leaf.decimals < 0 ||
-                    leaf.decimals > MAX_ORACLE_THRESHOLD_DECIMALS) {
-                    throw malformed(`oracle_threshold.decimals out of range (0..${MAX_ORACLE_THRESHOLD_DECIMALS}) at ${path}`);
-                }
-                return;
-            case 'literal_vec':
-                leaf.elements.forEach((e, i) => {
-                    walkLeaf(e, `${path}.elements[${i}]`);
-                });
-                return;
-            // Selector and other leaves carry no cap-set values; the call_arg
-            // branches above cover indices, the literal branches cover typed
-            // constants. amount / window_spent / invocation_count / now /
-            // valid_until / call_contract / call_fn / literal_address /
-            // literal_symbol / literal_u64 / oracle_price are all value-free
-            // at this gate.
-            case 'amount':
-            case 'window_spent':
-            case 'invocation_count_in_window':
-            case 'now':
-            case 'valid_until':
             case 'call_contract':
             case 'call_fn':
             case 'literal_address':
             case 'literal_symbol':
-            case 'literal_u64':
-            case 'oracle_price':
                 return;
         }
     }
     function walkNode(n, path) {
         switch (n.op) {
             case 'and':
-            case 'or':
                 n.children.forEach((c, i) => {
                     walkNode(c, `${path}.children[${i}]`);
                 });
                 return;
-            case 'not':
-                walkNode(n.child, `${path}.child`);
-                return;
             case 'eq':
-            case 'lt':
             case 'lte':
-            case 'gt':
-            case 'gte':
                 walkLeaf(n.left, `${path}.left`);
                 walkLeaf(n.right, `${path}.right`);
                 return;

package/dist-cjs/predicate/from-json.js

@@ -20,15 +20,9 @@ function jsonToAst(value) {
     const v = value;
     switch (v.op) {
         case 'and':
-        case 'or':
-            return { op: v.op, children: arrayOf(v.children, jsonToAst) };
-        case 'not':
-            return { op: 'not', child: jsonToAst(v.child) };
+            return { op: 'and', children: arrayOf(v.children, jsonToAst) };
         case 'eq':
-        case 'lt':
         case 'lte':
-        case 'gt':
-        case 'gte':
             return { op: v.op, left: jsonToLeaf(v.left), right: jsonToLeaf(v.right) };
         case 'in':
             return { op: 'in', needle: jsonToLeaf(v.needle), haystack: arrayOf(v.haystack, jsonToLeaf) };
@@ -48,42 +42,11 @@ function jsonToLeaf(value) {
     switch (v.kind) {
         case 'call_contract':
         case 'call_fn':
-        case 'now':
-        case 'valid_until':
             return { kind: v.kind };
         case 'call_arg':
             return { kind: 'call_arg', index: numberField(v, 'index') };
         case 'call_arg_len':
             return { kind: 'call_arg_len', index: numberField(v, 'index') };
-        // num/den are strings, not numbers: they are i128 on chain, and a JSON
-        // number would silently lose precision past 2^53 before the encoder
-        // ever saw the value.
-        case 'call_arg_scaled':
-            return {
-                kind: 'call_arg_scaled',
-                index: numberField(v, 'index'),
-                num: stringField(v, 'num'),
-                den: stringField(v, 'den'),
-            };
-        case 'call_arg_field':
-            return {
-                kind: 'call_arg_field',
-                index: numberField(v, 'index'),
-                element: numberField(v, 'element'),
-                field: stringField(v, 'field'),
-            };
-        case 'amount':
-            return { kind: 'amount', token: stringField(v, 'token') };
-        case 'window_spent':
-            return {
-                kind: 'window_spent',
-                token: stringField(v, 'token'),
-                windowSeconds: numberField(v, 'windowSeconds'),
-            };
-        case 'invocation_count_in_window':
-            return { kind: 'invocation_count_in_window', windowSecs: numberField(v, 'windowSecs') };
-        case 'oracle_price':
-            return { kind: 'oracle_price', asset: stringField(v, 'asset') };
         case 'literal_address':
             return { kind: 'literal_address', value: stringField(v, 'value') };
         case 'literal_i128':
@@ -92,10 +55,6 @@ function jsonToLeaf(value) {
             return { kind: 'literal_symbol', value: stringField(v, 'value') };
         case 'literal_u32':
             return { kind: 'literal_u32', value: numberField(v, 'value') };
-        case 'literal_u64':
-            return { kind: 'literal_u64', value: stringField(v, 'value') };
-        case 'literal_bytes':
-            return { kind: 'literal_bytes', value: stringField(v, 'value') };
         case 'literal_vec':
             return { kind: 'literal_vec', elements: arrayOf(v.elements, jsonToLeaf) };
         default:

package/dist-cjs/record/decode.js

@@ -340,14 +340,9 @@ function recordInvocation(contract, fn, args, network, knownSet, knownContractSe
     // parseConfidence denominator isn't inflated by repeat calls), but each
     // unrecognised invocation is recorded separately so the numerator
     // reflects every fail-closed hit.
-    if (knownSet.has(contract)) {
-        if (!knownContractSet.has(contract)) {
-            knownContractSet.add(contract);
-            knownOut.push(contract);
-        }
-        return;
-    }
-    if ((0, identify_ts_1.identifyProtocol)(contract, fn, args, network ?? undefined)) {
+    // `||` short-circuits, so `identifyProtocol` is still only consulted when the
+    // contract is not already in `knownSet` - the same call order as before.
+    if (knownSet.has(contract) || (0, identify_ts_1.identifyProtocol)(contract, fn, args, network ?? undefined)) {
         if (!knownContractSet.has(contract)) {
             knownContractSet.add(contract);
             knownOut.push(contract);

package/dist-cjs/review-card/builder.d.ts

@@ -1,5 +1,4 @@
-import type { ContextRuleDraft, PolicyRef, PredicateNode } from '../types.ts';
-import type { SimulationResult } from '../verify/envelope.ts';
+import type { ContextRuleDraft, PredicateNode } from '../types.ts';
 export interface ReviewCardSummary {
     ruleName: string;
     plainEnglish: string;
@@ -17,7 +16,9 @@ export interface ReviewCardSummary {
 }
 /** Build a deterministic review-card summary from a policy + context rule +
  *  simulation result. Pure: same inputs -> byte-identical output. */
-export declare function buildReviewCardSummary(predicate: PredicateNode | null, policyRefs: PolicyRef[], contextRule: ContextRuleDraft, simulation: SimulationResult): ReviewCardSummary;
+export declare function buildReviewCardSummary(predicate: PredicateNode | null, contextRule: ContextRuleDraft, 
+/** Evaluator identity folded into the content hash. */
+backend: 'interpreter-v1' | 'ts-model'): ReviewCardSummary;
 /** Walk every comparison / membership node of the predicate and invoke
  *  `visit` on each. The walk is depth-first, left-to-right, so the
  *  constraint list is stable across runs. Pure boolean nodes contribute no