@crediolabs/policy-synth 0.2.0 → 0.3.0

package/src/review-card/builder.ts

@@ -6,23 +6,13 @@
 // summary being REPRODUCIBLE + TESTABLE + NON-HALLUCINABLE, so this module is
 // pure: same inputs -> byte-identical output, no clock, no randomness, no I/O.
 //
-// The builder walks two inputs and emits ONE constraint string per leaf or
-// primitive, in a fixed deterministic order:
-//
-//   1. The OZ built-in `PolicyRef`s. Each `spending_limit` primitive becomes a
-//      `spending_limit(token, limitAmount, windowSecs)` line; other OZ
-//      primitives (threshold) are skipped - the review card does not quote
-//      them (they are signer-config concerns, not transactional bounds).
-//
-//   2. The interpreter `PredicateNode`. One string per constraint leaf,
-//      rendered by enclosing-comparison kind. Templates (Task 7b):
-//        - invocation_count_in_window < N     -> At most N calls per <window> seconds
-//        - call_arg[i] in [list]              -> Recipient/arg must be one of [list]
-//        - eq(call_arg[i], literal_vec[...])  -> Path must be exactly [list]
-//        - oracle_price(asset) OP price       -> Only when oracle_price(asset) OP price
-//        - call_fn == x                       -> Function must be x
-//        - call_contract == c                 -> Contract must be c
-//        - amount <= v                        -> Amount <= v
+// The builder walks the interpreter `PredicateNode` and emits ONE constraint
+// string per leaf, in a fixed deterministic order. Templates (Task 7b):
+//   - call_arg[i] in [list]              -> Recipient/arg must be one of [list]
+//   - eq(call_arg[i], literal_vec[...])  -> Path must be exactly [list]
+//   - call_fn == x                       -> Function must be x
+//   - call_contract == c                 -> Contract must be c
+//   - amount <= v                        -> Amount <= v
 //
 // The content hash is a stable sha256 hex of a canonical JSON of
 // { ruleName, plainEnglish, constraints, expiry, backend } - identical
@@ -30,14 +20,8 @@
 // hash. There is no clock; the hash never includes a timestamp.
 
 import { createHash } from 'node:crypto'
-import type {
-  ContextRuleDraft,
-  OZPrimitiveConfig,
-  PolicyRef,
-  PredicateLeaf,
-  PredicateNode,
-} from '../types.ts'
-import type { SimulationResult } from '../verify/envelope.ts'
+import type { ContextRuleDraft, PredicateNode } from '../types.ts'
+import { comparisonOpText, renderHaystackElement, renderVecElement } from './render-leaf.ts'
 
 export interface ReviewCardSummary {
   ruleName: string
@@ -59,15 +43,11 @@ export interface ReviewCardSummary {
  *  simulation result. Pure: same inputs -> byte-identical output. */
 export function buildReviewCardSummary(
   predicate: PredicateNode | null,
-  policyRefs: PolicyRef[],
   contextRule: ContextRuleDraft,
-  simulation: SimulationResult
+  /** Evaluator identity folded into the content hash. */
+  backend: 'interpreter-v1' | 'ts-model'
 ): ReviewCardSummary {
   const constraints: string[] = []
-  for (const ref of policyRefs) {
-    const line = renderOzPrimitive(ref)
-    if (line !== null) constraints.push(line)
-  }
   if (predicate !== null) {
     walkPredicate(predicate, (node) => {
       const line = renderConstraint(node)
@@ -86,7 +66,6 @@ export function buildReviewCardSummary(
     contextRule.signers.length >= 2
       ? 'any ONE signer may authorise a permitted op under this rule (OZ any-of-N semantic)'
       : null
-  const backend = simulation.backend
 
   const contentHash = computeContentHash({
     ruleName,
@@ -100,24 +79,6 @@ export function buildReviewCardSummary(
   return { ruleName, plainEnglish, constraints, expiry, signerNote, backend, contentHash }
 }
 
-/** Render the OZ built-in primitive summary line. Only `spending_limit` is
- *  quoted by the review card (it is the only primitive that defines a
- *  transactional bound). Other primitives (threshold) are signer-config
- *  concerns handled by the OZ adapter's own `uncovered` machinery.
- *  Spending_limit takes `period_ledgers` on-chain (~5s/ledger); the card
- *  states the window in seconds so the user reads it consistently with the
- *  interpreter templates. */
-function renderOzPrimitive(ref: PolicyRef): string | null {
-  if (ref.kind !== 'oz_builtin') return null
-  const primitive: OZPrimitiveConfig = ref.primitive
-  if (primitive.primitive !== 'spending_limit') return null
-  const params = primitive.params as { spending_limit?: string; period_ledgers?: number }
-  const limit = params.spending_limit ?? '0'
-  const periodLedgers = params.period_ledgers ?? 0
-  const windowSecs = periodLedgers * 5
-  return `spending_limit(${limit}, ${windowSecs})`
-}
-
 /** Walk every comparison / membership node of the predicate and invoke
  *  `visit` on each. The walk is depth-first, left-to-right, so the
  *  constraint list is stable across runs. Pure boolean nodes contribute no
@@ -142,20 +103,13 @@ export function describePredicate(predicate: PredicateNode): string[] {
 function walkPredicate(node: PredicateNode, visit: (node: PredicateNode) => void): void {
   switch (node.op) {
     case 'and':
-    case 'or':
       for (const child of node.children) walkPredicate(child, visit)
       return
-    case 'not':
-      walkPredicate(node.child, visit)
-      return
     case 'in':
       visit(node)
       return
     case 'eq':
-    case 'lt':
     case 'lte':
-    case 'gt':
-    case 'gte':
       visit(node)
       return
   }
@@ -164,27 +118,20 @@ function walkPredicate(node: PredicateNode, visit: (node: PredicateNode) => void
 /** Render ONE constraint sentence for ONE interpreter predicate node. The
  *  shape of the output is pinned by Task 7b so the test suite can assert
  *  byte-for-byte equality. Returns `null` when the node is a structural
- *  boolean (`and` / `or` / `not`) - those are not constraint leaves. */
+ *  boolean (`and`) - that is not a constraint leaf. */
 function renderConstraint(node: PredicateNode): string | null {
   switch (node.op) {
     case 'and':
-    case 'or':
-    case 'not':
       return null
     case 'eq':
-    case 'lt':
     case 'lte':
-    case 'gt':
-    case 'gte':
       return renderComparison(node)
     case 'in':
       return renderMembership(node)
   }
 }
 
-function renderComparison(
-  node: Extract<PredicateNode, { op: 'eq' | 'lt' | 'lte' | 'gt' | 'gte' }>
-): string | null {
+function renderComparison(node: Extract<PredicateNode, { op: 'eq' | 'lte' }>): string | null {
   const left = node.left
   const right = node.right
 
@@ -213,15 +160,13 @@ function renderComparison(
 
   // eq/lte(call_arg_field[i, el, field], <literal>) -> arg[i] element[el].field = <value>
   // The structured-argument bind pins a scalar field inside a vec element.
-  // For lt/gt/lte/gte the line reads "OP <value>" so the comparison kind
-  // is visible; eq reads "= <value>".
+  // For lte the line reads "OP <value>" so the comparison kind is visible;
+  // eq reads "= <value>".
   if (left.kind === 'call_arg_field') {
     const head = `arg[${left.index}] element[${left.element}].${left.field}`
     const sep = node.op === 'eq' ? '=' : comparisonOpText(node.op)
     if (right.kind === 'literal_address') return `${head} ${sep} ${right.value}`
     if (right.kind === 'literal_symbol') return `${head} ${sep} ${right.value}`
-    if (right.kind === 'literal_bytes') return `${head} ${sep} ${right.value}`
-    if (right.kind === 'literal_u64') return `${head} ${sep} ${right.value}`
     if (right.kind === 'literal_i128') return `${head} ${sep} ${right.value}`
     if (right.kind === 'literal_u32') return `${head} ${sep} ${right.value}`
     if (right.kind === 'literal_vec') {
@@ -229,23 +174,10 @@ function renderComparison(
     }
   }
 
-  // The bound is compared against the calls ALREADY made in the window, so
-  // `< N` permits N of them and `<= N` permits one more. Report how many
-  // calls the rule allows rather than restating the comparison.
-  if (left.kind === 'invocation_count_in_window' && right.kind === 'literal_u32') {
-    const allowed = node.op === 'lt' ? right.value : right.value + 1
-    return `At most ${allowed} calls per ${left.windowSecs} seconds`
-  }
-
-  // OP(call_arg[i], <scalar literal>) -> arg[i] OP <value>
-  //
-  // The per-call cap. It has to be here because the `amount` template below
-  // is unreachable for an interpreter policy: `amount` is deliberately not in
-  // the contract's grammar (dsl.rs - the interpreter sees one authorized
-  // call, not the transaction's token movements), so a predicate using it is
-  // refused at install. A bound on the call's own amount ARGUMENT is how a
-  // cap is actually written, and it was rendering nothing at all - the card
-  // silently understated the policy.
+  // The per-call cap: OP(call_arg[i], <scalar literal>) -> arg[i] OP <value>.
+  // The interpreter is passed one authorized call, not the transaction's token
+  // movements, so a bound on the call's own amount ARGUMENT is how a cap is
+  // written.
   //
   // Placed after the literal_vec case above so an exact-sequence `eq` still
   // reads as a path rather than as a comparison.
@@ -253,25 +185,9 @@ function renderComparison(
     const head = `arg[${left.index}]`
     const sep = node.op === 'eq' ? '=' : comparisonOpText(node.op)
     if (right.kind === 'literal_i128') return `${head} ${sep} ${right.value}`
-    if (right.kind === 'literal_u64') return `${head} ${sep} ${right.value}`
     if (right.kind === 'literal_u32') return `${head} ${sep} ${right.value}`
     if (right.kind === 'literal_address') return `${head} ${sep} ${right.value}`
     if (right.kind === 'literal_symbol') return `${head} ${sep} ${right.value}`
-    if (right.kind === 'literal_bytes') return `${head} ${sep} ${right.value}`
-    // call_arg_scaled is the slippage floor and reads as itself.
-    if (right.kind === 'call_arg_scaled') {
-      return `${head} >= arg[${right.index}] * ${right.num}/${right.den}`
-    }
-  }
-
-  // amount <= v -> Amount <= v
-  if (left.kind === 'amount' && right.kind === 'literal_i128') {
-    return `Amount <= ${right.value}`
-  }
-
-  // oracle_price(asset) OP price -> Only when oracle_price(asset) OP price
-  if (left.kind === 'oracle_price' && right.kind === 'oracle_threshold') {
-    return `Only when oracle_price(${left.asset}) ${comparisonOpText(node.op)} ${right.value} (${right.decimals} dp)`
   }
 
   // Any other comparison shape is a structural fail-closed: do not surface
@@ -291,71 +207,6 @@ function renderMembership(node: Extract<PredicateNode, { op: 'in' }>): string |
   return null
 }
 
-function renderVecElement(leaf: PredicateLeaf): string {
-  switch (leaf.kind) {
-    case 'literal_address':
-      return leaf.value
-    case 'literal_i128':
-      return leaf.value
-    case 'literal_symbol':
-      return leaf.value
-    case 'literal_u32':
-      return String(leaf.value)
-    case 'literal_u64':
-      return leaf.value
-    case 'literal_bytes':
-      return leaf.value
-    case 'literal_vec':
-      return `[${leaf.elements.map(renderVecElement).join(', ')}]`
-    case 'call_contract':
-    case 'call_fn':
-    case 'call_arg':
-    case 'call_arg_len':
-    case 'call_arg_field':
-    case 'call_arg_scaled':
-    case 'amount':
-    case 'window_spent':
-    case 'now':
-    case 'valid_until':
-    case 'invocation_count_in_window':
-    case 'oracle_price':
-      return `<${leaf.kind}>`
-    // Show the declared basis, not just the digits. A threshold on the wrong
-    // basis is the one policy error the contract cannot detect, so the review
-    // card is where a human has to be able to see it.
-    case 'oracle_threshold':
-      return `${leaf.value} (${leaf.decimals} dp)`
-  }
-}
-
-function renderHaystackElement(leaf: PredicateLeaf): string {
-  if (leaf.kind === 'literal_address') return leaf.value
-  if (leaf.kind === 'literal_i128') return leaf.value
-  if (leaf.kind === 'literal_symbol') return leaf.value
-  if (leaf.kind === 'literal_u32') return String(leaf.value)
-  if (leaf.kind === 'literal_u64') return leaf.value
-  if (leaf.kind === 'literal_bytes') return leaf.value
-  if (leaf.kind === 'literal_vec') {
-    return `[${leaf.elements.map(renderHaystackElement).join(', ')}]`
-  }
-  return `<${leaf.kind}>`
-}
-
-function comparisonOpText(op: 'eq' | 'lt' | 'lte' | 'gt' | 'gte'): string {
-  switch (op) {
-    case 'lt':
-      return '<'
-    case 'lte':
-      return '<='
-    case 'gt':
-      return '>'
-    case 'gte':
-      return '>='
-    case 'eq':
-      return '=='
-  }
-}
-
 /** Render the plain-English one-liner. Format: `<ruleName>: <constraints>`,
  *  joined by `; ` so the user reads one sentence per constraint. */
 function renderPlainEnglish(ruleName: string, constraints: string[]): string {

package/src/review-card/cross-check.ts

@@ -15,6 +15,7 @@
 
 import type { PredicateLeaf, PredicateNode } from '../types.ts'
 import type { ReviewCardSummary } from './builder.ts'
+import { comparisonOpText, renderHaystackElement, renderVecElement } from './render-leaf.ts'
 
 /** Assert every leaf in the predicate appears as a constraint string in
  *  `summary.constraints`. Returns the missing templates (without the leaf
@@ -43,17 +44,10 @@ export function summaryCrossCheck(
 function collect(node: PredicateNode, out: string[]): void {
   switch (node.op) {
     case 'and':
-    case 'or':
       for (const child of node.children) collect(child, out)
       return
-    case 'not':
-      collect(node.child, out)
-      return
     case 'eq':
-    case 'lt':
     case 'lte':
-    case 'gt':
-    case 'gte':
       pushComparison(node.left, node.right, node.op, out)
       return
     case 'in':
@@ -65,7 +59,7 @@ function collect(node: PredicateNode, out: string[]): void {
 function pushComparison(
   left: PredicateLeaf,
   right: PredicateLeaf,
-  op: 'eq' | 'lt' | 'lte' | 'gt' | 'gte',
+  op: 'eq' | 'lte',
   out: string[]
 ): void {
   if (left.kind === 'call_contract' && op === 'eq' && right.kind === 'literal_address') {
@@ -97,14 +91,6 @@ function pushComparison(
       out.push(`${head} ${sep} ${right.value}`)
       return
     }
-    if (right.kind === 'literal_bytes') {
-      out.push(`${head} ${sep} ${right.value}`)
-      return
-    }
-    if (right.kind === 'literal_u64') {
-      out.push(`${head} ${sep} ${right.value}`)
-      return
-    }
     if (right.kind === 'literal_i128') {
       out.push(`${head} ${sep} ${right.value}`)
       return
@@ -118,13 +104,6 @@ function pushComparison(
       return
     }
   }
-  // Mirrors the builder's wording byte-for-byte: how many calls the rule
-  // permits, since the bound counts the calls already made.
-  if (left.kind === 'invocation_count_in_window' && right.kind === 'literal_u32') {
-    const allowed = op === 'lt' ? right.value : right.value + 1
-    out.push(`At most ${allowed} calls per ${left.windowSecs} seconds`)
-    return
-  }
   // Mirrors the builder's per-call cap line. Both sides must render the same
   // string: cross-check compares the summary against the predicate, so a
   // shape only ONE of them renders would read as a dropped constraint.
@@ -133,29 +112,13 @@ function pushComparison(
     const sep = op === 'eq' ? '=' : comparisonOpText(op)
     if (
       right.kind === 'literal_i128' ||
-      right.kind === 'literal_u64' ||
       right.kind === 'literal_u32' ||
       right.kind === 'literal_address' ||
-      right.kind === 'literal_symbol' ||
-      right.kind === 'literal_bytes'
+      right.kind === 'literal_symbol'
     ) {
       out.push(`${head} ${sep} ${right.value}`)
       return
     }
-    if (right.kind === 'call_arg_scaled') {
-      out.push(`${head} >= arg[${right.index}] * ${right.num}/${right.den}`)
-      return
-    }
-  }
-  if (left.kind === 'amount' && right.kind === 'literal_i128') {
-    out.push(`Amount <= ${right.value}`)
-    return
-  }
-  if (left.kind === 'oracle_price' && right.kind === 'oracle_threshold') {
-    out.push(
-      `Only when oracle_price(${left.asset}) ${comparisonOpText(op)} ${right.value} (${right.decimals} dp)`
-    )
-    return
   }
 }
 
@@ -164,68 +127,3 @@ function pushMembership(needle: PredicateLeaf, haystack: PredicateLeaf[], out: s
   const list = haystack.map(renderHaystackElement).join(', ')
   out.push(`Recipient/arg must be one of [${list}]`)
 }
-
-function renderVecElement(leaf: PredicateLeaf): string {
-  switch (leaf.kind) {
-    case 'literal_address':
-      return leaf.value
-    case 'literal_i128':
-      return leaf.value
-    case 'literal_symbol':
-      return leaf.value
-    case 'literal_u32':
-      return String(leaf.value)
-    case 'literal_u64':
-      return leaf.value
-    case 'literal_bytes':
-      return leaf.value
-    case 'literal_vec':
-      return `[${leaf.elements.map(renderVecElement).join(', ')}]`
-    case 'call_contract':
-    case 'call_fn':
-    case 'call_arg':
-    case 'call_arg_len':
-    case 'call_arg_field':
-    case 'call_arg_scaled':
-    case 'amount':
-    case 'window_spent':
-    case 'now':
-    case 'valid_until':
-    case 'invocation_count_in_window':
-    case 'oracle_price':
-      return `<${leaf.kind}>`
-    // Show the declared basis, not just the digits. A threshold on the wrong
-    // basis is the one policy error the contract cannot detect, so the review
-    // card is where a human has to be able to see it.
-    case 'oracle_threshold':
-      return `${leaf.value} (${leaf.decimals} dp)`
-  }
-}
-
-function renderHaystackElement(leaf: PredicateLeaf): string {
-  if (leaf.kind === 'literal_address') return leaf.value
-  if (leaf.kind === 'literal_i128') return leaf.value
-  if (leaf.kind === 'literal_symbol') return leaf.value
-  if (leaf.kind === 'literal_u32') return String(leaf.value)
-  if (leaf.kind === 'literal_u64') return leaf.value
-  if (leaf.kind === 'literal_bytes') return leaf.value
-  if (leaf.kind === 'literal_vec') {
-    return `[${leaf.elements.map(renderHaystackElement).join(', ')}]`
-  }
-  return `<${leaf.kind}>`
-}
-
-function comparisonOpText(op: 'eq' | 'lt' | 'lte' | 'gt' | 'gte'): string {
-  switch (op) {
-    case 'lt':
-      return '<'
-    case 'lte':
-      return '<='
-    case 'gt':
-      return '>'
-    case 'gte':
-      return '>='
-    case 'eq':
-      return '=='
-  }
-}

package/src/review-card/render-leaf.ts

@@ -0,0 +1,48 @@
+// Leaf and operator rendering shared by the review-card builder and the
+// summary cross-check. Both turn the SAME predicate into human-readable text -
+// the cross-check exists to confirm the builder's summary matches the predicate
+// - so rendering a leaf differently in the two would make the check compare a
+// string against itself under a different spelling and pass on a real mismatch.
+
+import type { PredicateLeaf } from '../types.ts'
+
+export function renderVecElement(leaf: PredicateLeaf): string {
+  switch (leaf.kind) {
+    case 'literal_address':
+      return leaf.value
+    case 'literal_i128':
+      return leaf.value
+    case 'literal_symbol':
+      return leaf.value
+    case 'literal_u32':
+      return String(leaf.value)
+    case 'literal_vec':
+      return `[${leaf.elements.map(renderVecElement).join(', ')}]`
+    case 'call_contract':
+    case 'call_fn':
+    case 'call_arg':
+    case 'call_arg_len':
+    case 'call_arg_field':
+      return `<${leaf.kind}>`
+  }
+}
+
+export function renderHaystackElement(leaf: PredicateLeaf): string {
+  if (leaf.kind === 'literal_address') return leaf.value
+  if (leaf.kind === 'literal_i128') return leaf.value
+  if (leaf.kind === 'literal_symbol') return leaf.value
+  if (leaf.kind === 'literal_u32') return String(leaf.value)
+  if (leaf.kind === 'literal_vec') {
+    return `[${leaf.elements.map(renderHaystackElement).join(', ')}]`
+  }
+  return `<${leaf.kind}>`
+}
+
+export function comparisonOpText(op: 'eq' | 'lte'): string {
+  switch (op) {
+    case 'lte':
+      return '<='
+    case 'eq':
+      return '=='
+  }
+}