@crediolabs/policy-synth 0.2.0 → 0.3.0

package/src/synth/synthesize-from-recording.ts

@@ -1,46 +1,37 @@
 // src/synth/synthesize-from-recording.ts - recording-path orchestrator.
 //
 // `synthesizeFromRecording` INFERS a bounded policy from a `RecordedTransaction`
-// via the same `PolicyIR` + adapter pair used by the deterministic Mandate path.
+// via the `PolicyIR` + interpreter adapter pair.
 // Flow: validate -> parseConfidence gate -> lower -> decideScope -> composeFromRecording
-// -> OZ compile -> (opt-in) interpreter compile + self-verify + minimise -> merge.
-// Same (tx, opts, ozConfig) -> byte-identical ProposedPolicy (no randomness, clock, globals).
+// -> interpreter compile + self-verify.
+// Same (tx, opts) -> byte-identical ProposedPolicy (no randomness, clock, globals).
 
 import type { InterpreterAdapterConfig } from '../adapters/interpreter/adapter.ts'
 import {
-  createInterpreterAdapter,
+  compileInterpreterPolicy,
   lowerRuleToPredicate,
   PLACEHOLDER_INTERPRETER_ADDRESS,
 } from '../adapters/interpreter/adapter.ts'
-import type { OzAdapterConfig } from '../adapters/oz/adapter.ts'
-import { createOzAdapter } from '../adapters/oz/adapter.ts'
 import type { ToolError, ToolResponse } from '../errors.ts'
 import { encodePredicate } from '../predicate/encode.ts'
 import {
-  type ContractInvocation,
-  MAX_SCVAL_CLONE_DEPTH,
+  GRAMMAR_VERSION,
   type Network,
   OZ_LIMITS,
-  type PredicateLeaf,
   type PredicateNode,
   type ProposedPolicy,
   type RecordedTransaction,
   SOROBAN_LIMITS,
 } from '../types.ts'
-import type { SimulationResult } from '../verify/envelope.ts'
 import {
   type ComposeOptions,
   type ComposeUserResponses,
   composeFromRecording,
 } from './compose-from-recording.ts'
-import { generateCases, ORIGINAL_DIMENSIONS } from './deny-cases.ts'
-import { type EvalContext, evaluate } from './evaluate.ts'
-import { runHarness } from './harness.ts'
 import { lower } from './lower.ts'
-import { minimize } from './minimize.ts'
 import { decideScope, type ScopeDecision } from './scope.ts'
 
-const UNCOVERED_PREFIX = 'Not covered by OZ built-in primitives: '
+const UNCOVERED_PREFIX = 'Not expressible as a predicate constraint: '
 
 /** Per-policy interpreter adapter config the caller opts into. Absent ->
  *  recording path runs in week-1 mode (OZ adapter only, warnings for the
@@ -52,10 +43,6 @@ export interface InterpreterAdapterOptions {
   smartAccountAddress: string
   /** Per-rule install nonce (first install = 1). Defaults to 1. */
   installNonce?: number
-  /** Per-policy oracle overrides. Tighten-only vs the wasm defaults
-   *  (maxStalenessSeconds <= 600, maxDeviationBps <= 200); widening is
-   *  rejected at the options boundary. */
-  oracleParams?: { maxStalenessSeconds?: number; maxDeviationBps?: number }
 }
 
 /** PRIVATE test-only extension of `InterpreterAdapterOptions` for the
@@ -82,8 +69,7 @@ export interface SynthesizeFromRecordingOptions {
 
 export function synthesizeFromRecording(
   tx: RecordedTransaction,
-  opts: SynthesizeFromRecordingOptions,
-  ozConfig: OzAdapterConfig
+  opts: SynthesizeFromRecordingOptions
 ): ToolResponse<ProposedPolicy> & {
   /** Present iff `opts.explain === true` and the synthesis succeeded. The
    *  `predicateTree` is the exact in-memory `PredicateNode` (canonical
@@ -97,16 +83,15 @@ export function synthesizeFromRecording(
    *  builds a minimal honest SimulationResult downstream. */
   explain?: {
     predicateTree: PredicateNode | null
-    simulation: SimulationResult
   }
 } {
   // Convert any ToolError-shaped throw (object with a string `.code`) to a
   // structured `{ok:false, error}`; anything else is rethrown so genuine bugs
   // crash instead of being silently swallowed. Wraps the entire body so
-  // cap errors (PREDICATE_TOO_DEEP, TOO_MANY_LEAVES) and cloneScVal depth
+  // cap errors (PREDICATE_TOO_DEEP, TOO_MANY_LEAVES) and encoder depth
   // throws surface as structured ToolErrors rather than RangeErrors.
   try {
-    return synthesizeFromRecordingInner(tx, opts, ozConfig)
+    return synthesizeFromRecordingInner(tx, opts)
   } catch (e) {
     if (isToolErrorShape(e)) {
       return {
@@ -145,12 +130,10 @@ function throwToolError(code: ToolError['code'], message: string): never {
 
 function synthesizeFromRecordingInner(
   tx: RecordedTransaction,
-  opts: SynthesizeFromRecordingOptions,
-  ozConfig: OzAdapterConfig
+  opts: SynthesizeFromRecordingOptions
 ): ToolResponse<ProposedPolicy> & {
   explain?: {
     predicateTree: PredicateNode | null
-    simulation: SimulationResult
   }
 } {
   // 0. validate inputs (fail closed - never synthesize from garbage).
@@ -250,7 +233,6 @@ function synthesizeFromRecordingInner(
   const topLevel = tx.invocations[0] ?? null
   const composeOpts: ComposeOptions = {
     network: opts.network,
-    interpreterEnabled: opts.interpreter !== undefined,
     ...(opts.userResponses !== undefined ? { userResponses: opts.userResponses } : {}),
   }
   const composed = composeFromRecording(facts, scope.contract, topLevel, composeOpts)
@@ -259,24 +241,6 @@ function synthesizeFromRecordingInner(
   // self-verify verdict (built from the SAME runHarness + evaluate that gated
   // the synthesis, not a parallel simulation).
   let explain: PredicateNode | null = null
-  let explainSim: SimulationResult | null = null
-
-  // 5. OZ compile (always runs).
-  const ozAdapter = createOzAdapter(ozConfig)
-  const compileRes = ozAdapter.compile(composed.ir)
-
-  if (!compileRes.proposed) {
-    return {
-      ok: false,
-      error: {
-        code: 'SYNTHESIS_ERROR',
-        message: `recording lowered to no installable OZ policy: ${compileRes.uncovered.join('; ')}`,
-        severity: 'error',
-        retryable: false,
-        details: { uncovered: compileRes.uncovered },
-      },
-    }
-  }
 
   // 6. Interpreter compile (opt-in; fail-closed when the user routed real
   //    restrictions to the interpreter).
@@ -284,17 +248,13 @@ function synthesizeFromRecordingInner(
 
   let interpreterPolicyDocument: ProposedPolicy['policyDocuments'][number] | null = null
   let interpreterPolicyRef: ProposedPolicy['policyRefs'][number] | null = null
-  // Cross-layer L3: declared OUTSIDE the `if (interpreterOpts)` block so the
-  // warnings folded into `proposed.warnings[]` (which lives after that block)
-  // can read it. The block assigns it; the default is empty.
-  let permitCtxWarnings: string[] = []
+  let interpreterContextRule: ProposedPolicy['contextRule'] | null = null
 
   if (interpreterOpts) {
     const interpreterConfig: InterpreterAdapterConfig = {
       network: opts.network,
       installNonce: interpreterOpts.installNonce ?? 1,
       smartAccountAddress: interpreterOpts.smartAccountAddress,
-      ...(interpreterOpts.oracleParams ? { oracleParams: interpreterOpts.oracleParams } : {}),
     }
 
     let startingPredicate: PredicateNode | null = null
@@ -313,23 +273,18 @@ function synthesizeFromRecordingInner(
       }
       startingPredicate = testSeam
     } else {
-      const interpreterAdapter = createInterpreterAdapter(interpreterConfig)
-
-      let interpreterRes: Awaited<ReturnType<typeof interpreterAdapter.compile>>
+      let interpreterRes: ReturnType<typeof compileInterpreterPolicy>
       try {
-        interpreterRes = interpreterAdapter.compile(composed.interpreterIr)
+        interpreterRes = compileInterpreterPolicy(composed.interpreterRule, interpreterConfig)
       } catch (e) {
         const code = (e as { code?: ToolError['code'] }).code
         const allowedCodes: ToolError['code'][] = [
           'SCOPE_SELF_CALL',
-          'ORACLE_LEAF_INVALID_POSITION',
-          'ORACLE_PARAMS_OUT_OF_RANGE',
           'MALFORMED_PREDICATE',
           'PREDICATE_TOO_LARGE',
           'PREDICATE_TOO_DEEP',
           'TOO_MANY_LEAVES',
           'IN_OPERAND_LIMIT',
-          'PREDICATE_ORACLE_OVER_LIMIT',
         ]
         const surfacedCode = code && allowedCodes.includes(code) ? code : 'SYNTHESIS_ERROR'
         return {
@@ -370,6 +325,7 @@ function synthesizeFromRecordingInner(
 
       interpreterPolicyDocument = interpreterRes.proposed.policyDocuments[0] ?? null
       interpreterPolicyRef = interpreterRes.proposed.policyRefs[0] ?? null
+      interpreterContextRule = interpreterRes.proposed.contextRule
       if (!interpreterPolicyDocument || !interpreterPolicyRef) {
         return {
           ok: false,
@@ -382,7 +338,7 @@ function synthesizeFromRecordingInner(
         }
       }
 
-      const firstInterpreterRule = composed.interpreterIr.rules[0]
+      const firstInterpreterRule = composed.interpreterRule
       if (!firstInterpreterRule) {
         return {
           ok: false,
@@ -409,7 +365,9 @@ function synthesizeFromRecordingInner(
       }
     }
 
-    // 6b. Self-verify + minimise.
+    // 6b. The predicate is used as compiled. There is no minimisation pass:
+    //     nothing strips a leaf and re-checks that the reduced predicate still
+    //     denies, so the result is NOT a proven-minimal policy.
     if (!topLevel) {
       return {
         ok: false,
@@ -432,93 +390,24 @@ function synthesizeFromRecordingInner(
         },
       }
     }
-    // Cross-layer L3: warnings collected from `buildPermitContext` (currently
-    // only the oracle-on-right normaliser) and folded into the proposed
-    // policy's `warnings[]` so the caller sees them on the success envelope.
-    const permitCtxResult = buildPermitContext(
-      tx,
-      scope,
-      topLevel,
-      opts.userResponses,
-      startingPredicate
-    )
-    const permitCtx = permitCtxResult.ctx
-    permitCtxWarnings = permitCtxResult.warnings
-
-    const finalPredicate: PredicateNode =
-      startingPredicate.op === 'and'
-        ? minimize(startingPredicate, permitCtx, ORIGINAL_DIMENSIONS)
-        : startingPredicate
-
-    const harnessCases = generateCases(finalPredicate, permitCtx, ORIGINAL_DIMENSIONS)
-    const harnessResult = runHarness(finalPredicate, harnessCases)
-    if (!harnessResult.ok) {
-      return {
-        ok: false,
-        error: {
-          code: 'DENY_CASE_FAILURE',
-          message: `self-verify harness failed for the interpreter predicate (${harnessResult.failures.length} failure(s))`,
-          severity: 'error',
-          retryable: false,
-          details: { failures: harnessResult.failures },
-        },
-      }
-    }
-    const evalResult = evaluate(finalPredicate, permitCtx)
-    if (!evalResult.permit) {
-      return {
-        ok: false,
-        error: {
-          code: 'DENY_CASE_FAILURE',
-          message: `intended recorded call was denied by the interpreter predicate: ${evalResult.reason}`,
-          severity: 'error',
-          retryable: false,
-          details: { reason: evalResult.reason },
-        },
-      }
-    }
+    const finalPredicate: PredicateNode = startingPredicate
 
-    // --explain capture: quote the SAME verdict that gated the synthesis.
-    // Re-evaluate each deny case to surface its concrete reason (the harness
-    // only records whether the got-matches-expected boundary held).
     if (opts.explain) {
       explain = finalPredicate
-      const evaluatedCases: SimulationResult['evaluatedCases'] = [
-        {
-          dimension: 'permit',
-          outcome: evalResult.permit ? 'permit' : 'deny',
-          reason: 'matches recorded call',
-        },
-      ]
-      for (const deny of harnessCases.denies) {
-        const r = evaluate(finalPredicate, deny.ctx)
-        evaluatedCases.push({
-          dimension: deny.dimension,
-          outcome: r.permit ? 'permit' : 'deny',
-          reason: r.permit ? 'no matching deny' : r.reason,
-        })
-      }
-      explainSim = {
-        permit: { tx: 'permit' },
-        evaluatedCases,
-        backend: 'ts-model',
-        simulatorVersion: 'ts-model-1.0.0',
-      }
     }
 
-    // 6c. Re-encode the (possibly minimised) PredicateNode and stamp the
-    //     canonical bytes back onto the PolicyDocument + PolicyRef. Cap breaches
+    // 6c. Encode the PredicateNode and stamp the canonical bytes back onto
+    //     the PolicyDocument + PolicyRef. Cap breaches
     //     (PREDICATE_TOO_DEEP, TOO_MANY_LEAVES) throw ToolError-shaped errors;
     //     the outer envelope converts them to structured `{ok:false, error}`.
     const { encodedPredicate, predicateHash } = encodePredicate(finalPredicate)
 
     if (testSeam !== undefined) {
       interpreterPolicyDocument = {
-        grammarVersion: 1,
+        grammarVersion: GRAMMAR_VERSION,
         installNonce: interpreterOpts.installNonce ?? 1,
         encodedPredicate,
         predicateHash,
-        ...(interpreterOpts.oracleParams ? { oracleParams: interpreterOpts.oracleParams } : {}),
       }
       interpreterPolicyRef = {
         kind: 'interpreter',
@@ -551,19 +440,25 @@ function synthesizeFromRecordingInner(
     }
   }
 
-  // When the interpreter succeeds, OZ-side `uncovered` warnings that the
-  // interpreter actually lowered are misleading: OZ really did not lower them,
-  // but the interpreter did. Drop those so the user-facing warnings reflect
-  // what is still UN-enforced, not what OZ alone could not do.
-  const ozUncovered = interpreterPolicyRef
-    ? compileRes.uncovered.filter((u) => !INTERPRETER_COVERED_OZ_PATTERN.test(u))
-    : compileRes.uncovered
+  // 7. Assemble the ProposedPolicy. The interpreter is the only backend, so
+  //    its context rule and policy ref are the whole policy. Without interpreter
+  //    options nothing installable was produced, which is an error rather than
+  //    an empty-but-successful policy.
+  if (!interpreterContextRule || !interpreterPolicyRef) {
+    return {
+      ok: false,
+      error: {
+        code: 'SYNTHESIS_ERROR',
+        message:
+          'no installable policy was synthesised: supply `interpreter` options (a smart account address) so the recording can be lowered to an interpreter predicate',
+        severity: 'error',
+        retryable: false,
+        details: { uncovered: composed.warnings },
+      },
+    }
+  }
 
-  // 7. Merge into the OZ-shaped ProposedPolicy.
-  const ozRefs = compileRes.proposed.policyRefs
-  const mergedRefs: ProposedPolicy['policyRefs'] = []
-  if (interpreterPolicyRef) mergedRefs.push(interpreterPolicyRef)
-  for (const r of ozRefs) mergedRefs.push(r)
+  const mergedRefs: ProposedPolicy['policyRefs'] = [interpreterPolicyRef]
 
   if (mergedRefs.length > OZ_LIMITS.maxPoliciesPerRule) {
     return {
@@ -578,7 +473,7 @@ function synthesizeFromRecordingInner(
   }
 
   const mergedContextRule = {
-    ...compileRes.proposed.contextRule,
+    ...interpreterContextRule,
     policies: mergedRefs,
   }
 
@@ -598,12 +493,7 @@ function synthesizeFromRecordingInner(
     policyDocuments: interpreterPolicyDocument ? [interpreterPolicyDocument] : [],
     policyRefs: mergedRefs,
     parseConfidence: { ...tx.parseConfidence },
-    warnings: [
-      ...zeroPolicyWarning,
-      ...ozUncovered.map((u) => `${UNCOVERED_PREFIX}${u}`),
-      ...composed.warnings.map((w) => `${UNCOVERED_PREFIX}${w}`),
-      ...permitCtxWarnings,
-    ],
+    warnings: [...zeroPolicyWarning, ...composed.warnings.map((w) => `${UNCOVERED_PREFIX}${w}`)],
     ambiguities: mergeAmbiguities(composed.ambiguities, scope.ambiguities),
   }
   // --explain success envelope. When opts.explain is set and the OZ-only
@@ -613,48 +503,16 @@ function synthesizeFromRecordingInner(
   const envelope: ToolResponse<ProposedPolicy> & {
     explain?: {
       predicateTree: PredicateNode | null
-      simulation: SimulationResult
     }
   } = { ok: true, data: proposed }
   if (opts.explain) {
-    if (explainSim) {
-      envelope.explain = { predicateTree: explain, simulation: explainSim }
-    } else {
-      envelope.explain = {
-        predicateTree: null,
-        simulation: {
-          permit: {
-            tx: 'deny',
-            reason: 'No self-verification was performed (interpreter adapter was not engaged)',
-          },
-          evaluatedCases: [],
-          backend: 'ts-model',
-          simulatorVersion: 'not-run',
-        },
-      }
-    }
+    envelope.explain = { predicateTree: explain }
   }
   return envelope
 }
 
 export { throwToolError }
 
-/** OZ-side `uncovered` warning patterns the interpreter adapter actually lowers
- *  when wired in. When the interpreter adapter succeeds, matching entries are
- *  dropped from the OZ uncovered list so user-facing warnings reflect what is
- *  still UN-enforced rather than what OZ alone could not do. Matches the
- *  exact descriptor strings the OZ adapter emits (see `src/adapters/oz/adapter.ts`
- *  `describeCondition` / `describeSelector`). */
-const INTERPRETER_COVERED_OZ_PATTERN =
-  /^per-method scoping to|^value allowlist on arg|^exact ordered sequence on arg|^oracle price condition on|^invocation-count window|^spending_limit on token .+ needs a CallContract context scoped to that token/
-
-/** Reject non-sane inputs before any policy is synthesized. windowSeconds /
- *  validUntilLedger / invocationLimit must be positive integers; limitAmount a
- *  positive i128 decimal string; network mainnet|testnet. When the interpreter
- *  adapter is opted in, `smartAccountAddress` must be a C... contract address
- *  (the on-chain policy-bound account, NOT the G... source account),
- *  `installNonce` must fit u32 (default 1), and `oracleParams` must
- *  tighten-only vs the wasm defaults. */
 function validateOptions(opts: SynthesizeFromRecordingOptions): ToolError | null {
   if (opts.network !== 'mainnet' && opts.network !== 'testnet') {
     return synthesisError(`network must be 'mainnet' or 'testnet', got: ${String(opts.network)}`)
@@ -669,9 +527,6 @@ function validateOptions(opts: SynthesizeFromRecordingOptions): ToolError | null
   }
   const ur = opts.userResponses
   if (ur) {
-    if (ur.windowSeconds !== undefined && !isPositiveInt(ur.windowSeconds)) {
-      return synthesisError(`windowSeconds must be a positive integer, got: ${ur.windowSeconds}`)
-    }
     if (
       ur.validUntilLedger !== undefined &&
       (!isPositiveInt(ur.validUntilLedger) || ur.validUntilLedger > SOROBAN_LIMITS.u32Max)
@@ -680,11 +535,6 @@ function validateOptions(opts: SynthesizeFromRecordingOptions): ToolError | null
         `validUntilLedger must be a positive u32 ledger sequence (<= ${SOROBAN_LIMITS.u32Max}), got: ${ur.validUntilLedger}`
       )
     }
-    if (ur.invocationLimit !== undefined && !isPositiveInt(ur.invocationLimit)) {
-      return synthesisError(
-        `invocationLimit must be a positive integer, got: ${ur.invocationLimit}`
-      )
-    }
     if (ur.limitAmount !== undefined && !isPositiveI128(ur.limitAmount)) {
       return synthesisError(
         `limitAmount must be a positive i128 decimal string within [1, ${I128_MAX}] (2^127-1), got: ${ur.limitAmount}`
@@ -718,27 +568,6 @@ function validateOptions(opts: SynthesizeFromRecordingOptions): ToolError | null
         `interpreter.installNonce must be a positive u32 integer (<= ${SOROBAN_LIMITS.u32Max}), got: ${nonce}`
       )
     }
-    const op = opts.interpreter.oracleParams
-    if (op) {
-      const MAX_STALE = 600
-      const MAX_DEV = 200
-      if (
-        op.maxStalenessSeconds !== undefined &&
-        (!isPositiveInt(op.maxStalenessSeconds) || op.maxStalenessSeconds > MAX_STALE)
-      ) {
-        return synthesisError(
-          `interpreter.oracleParams.maxStalenessSeconds must be a positive integer <= ${MAX_STALE} (tighten-only), got: ${op.maxStalenessSeconds}`
-        )
-      }
-      if (
-        op.maxDeviationBps !== undefined &&
-        (!isPositiveInt(op.maxDeviationBps) || op.maxDeviationBps > MAX_DEV)
-      ) {
-        return synthesisError(
-          `interpreter.oracleParams.maxDeviationBps must be a positive integer <= ${MAX_DEV} (tighten-only), got: ${op.maxDeviationBps}`
-        )
-      }
-    }
   }
   return null
 }
@@ -798,245 +627,3 @@ function mergeAmbiguities(
   }
   return out
 }
-
-/** Build the permit `EvalContext` the self-verify harness drives. Shape
- *  mirrors the intended recorded call so:
- *    - `evaluate(predicate, ctx).permit === true` must hold (a failure
- *      surfaces as DENY_CASE_FAILURE).
- *    - `generateCases(predicate, ctx)` produces a deny battery that reflects
- *      the actual recorded move (real amount, args, window start).
- *  Amounts are summed per-token over all movements (BigInt, never lossy).
- *  `oraclePriceByAsset` contains a price+timestamp satisfying each
- *  `oracle_price` leaf so the intended call permits under every bound;
- *  the harness mutates those entries (stale / missing / deviation / paused)
- *  to exercise the ORACLE_* deny paths. */
-function buildPermitContext(
-  tx: RecordedTransaction,
-  scope: Extract<ScopeDecision, { kind: 'call_contract' }>,
-  topLevel: ContractInvocation,
-  userResponses: ComposeUserResponses | undefined,
-  predicate: PredicateNode
-): { ctx: EvalContext; warnings: string[] } {
-  const amountByToken: Record<string, string> = {}
-  const totals = new Map<string, bigint>()
-  for (const m of tx.tokenMovements) {
-    const current = totals.get(m.token) ?? 0n
-    totals.set(m.token, current + BigInt(m.amount))
-  }
-  for (const [token, total] of totals) {
-    amountByToken[token] = total.toString()
-  }
-
-  const warnings: string[] = []
-  const oraclePriceByAsset: EvalContext['oraclePriceByAsset'] = oracleSatisfyingPrices(
-    predicate,
-    tx.fetchedAt,
-    warnings
-  )
-
-  const ctx: EvalContext = {
-    contract: scope.contract,
-    fn: topLevel.fn,
-    args: topLevel.args.map(cloneScVal),
-    atLedger: tx.ledgerSequence,
-    nowSeconds: tx.fetchedAt,
-    amountByToken,
-    windowSpentByToken: {},
-    invocationCountByWindow: {},
-    oraclePriceByAsset,
-  }
-  if (userResponses?.validUntilLedger !== undefined) {
-    ctx.validUntilLedger = userResponses.validUntilLedger
-  }
-  return { ctx, warnings }
-}
-
-function cloneScVal(
-  value: { type: string; value: unknown },
-  depth = 0
-): ContractInvocation['args'][number] {
-  // Clone top-level shells so the harness can mutate deny cases without
-  // aliasing the recorded call. Recursion bounded by MAX_SCVAL_CLONE_DEPTH so
-  // a hand-crafted nested-vec cannot RangeError the JS stack; the over-depth
-  // branch throws a ToolError-shaped error the envelope converts to
-  // `{ok:false, error}`.
-  if (value.type === 'vec') {
-    if (depth >= MAX_SCVAL_CLONE_DEPTH) {
-      throw cloneDepthError(value)
-    }
-    return {
-      type: 'vec',
-      value: (value.value as ContractInvocation['args'][number][]).map((v) =>
-        cloneScVal(v, depth + 1)
-      ),
-    }
-  }
-  return { ...value } as ContractInvocation['args'][number]
-}
-
-function cloneDepthError(value: { type: string; value: unknown }): never {
-  const err = new Error(
-    `ScVal clone depth exceeds MAX_SCVAL_CLONE_DEPTH (${MAX_SCVAL_CLONE_DEPTH})`
-  ) as Error & { code: string; severity: string; retryable: boolean; depthContext: unknown }
-  err.code = 'SYNTHESIS_ERROR'
-  err.severity = 'error'
-  err.retryable = false
-  err.depthContext = value.type
-  throw err
-}
-
-/** Walk every `oracle_price` leaf and return a price map whose entries satisfy
- *  the bound. Timestamp pinned to `nowSeconds` (the recorded `fetchedAt`) so
- *  the fresh-oracle deny case in `generateCases` is the only path that flips
- *  this map. Negatives clamped at 0 - oracle prices are non-negative on Stellar. */
-function oracleSatisfyingPrices(
-  predicate: PredicateNode,
-  nowSeconds: number,
-  warnings: string[]
-): EvalContext['oraclePriceByAsset'] {
-  const out: EvalContext['oraclePriceByAsset'] = {}
-  visitOracleLeaves(
-    predicate,
-    (asset, op, bound) => {
-      let price: bigint
-      switch (op) {
-        case 'lt':
-        case 'gt':
-          price = op === 'lt' ? bound - 1n : bound + 1n
-          break
-        case 'lte':
-        case 'gte':
-        case 'eq':
-          price = bound
-          break
-      }
-      if (price < 0n) price = 0n
-      out[asset] = { price: price.toString(), timestampSeconds: nowSeconds }
-    },
-    (warning) => {
-      // Cross-layer L3: oracle-on-right that cannot be normalised is
-      // surfaced as a warning, not silently dropped. The Rust interpreter
-      // would surface this as `UnsupportedNode`; the warning lets the
-      // caller decide whether to fix the predicate shape or accept the
-      // over-permissive hole.
-      warnings.push(warning.message)
-    }
-  )
-  return out
-}
-
-// Cross-layer L3: surface oracle-on-right as a WARNING rather than silently
-// dropping it. The Rust interpreter only fires `eval_oracle_compare` when the
-// oracle leaf is on the LEFT (`oracle_price op threshold`); a predicate that
-// inverts the shape (`threshold op oracle_price`) falls through to
-// `UnsupportedNode` instead. The TS model and the lowering path both attempt
-// to normalise oracle-on-right by flipping the operator so the oracle ends
-// up on the left, but the normalisation is only possible when the other
-// side is a literal we can read as a bigint (an `oracle_threshold`, an
-// `i128`/`u32`/`u64` literal). When it isn't (e.g. `oracle_price < call_arg[i]`),
-// the case cannot be normalised - previously we silently dropped it, which
-// means the harness would never exercise the bound and `minimize` could
-// prune it. The warning is purely additive: the existing normalisation
-// path is preserved, the case is just also reported so callers can decide
-// to either fix the predicate shape or accept the over-permissive hole.
-
-/** Diagnostic reported by `visitOracleLeaves` when an oracle comparison
- *  cannot be normalised to oracle-on-left. Currently only "oracle-on-right
- *  with a non-literal LHS" - the other branches already produce a parseable
- *  threshold and are returned to the caller. */
-export interface OracleNormalisationWarning {
-  /** The dimension name (currently always "oracle_normalisation_dropped"). */
-  dimension: 'oracle_normalisation_dropped'
-  /** The operator as written. */
-  op: 'eq' | 'lt' | 'lte' | 'gt' | 'gte'
-  /** The asset the oracle leaf is bound to. */
-  asset: string
-  /** The non-literal RHS (oracle-on-left) or LHS (oracle-on-right) leaf
-   *  whose shape stopped the normalisation. Surfaced for diagnostics;
-   *  intentionally a partial view - the full leaf is the caller's job. */
-  otherKind: string
-  /** Human-readable message (matches the warn-on-drop text). */
-  message: string
-}
-
-function visitOracleLeaves(
-  node: PredicateNode,
-  visit: (asset: string, op: 'eq' | 'lt' | 'lte' | 'gt' | 'gte', bound: bigint) => void,
-  onWarning?: (warning: OracleNormalisationWarning) => void
-): void {
-  switch (node.op) {
-    case 'and':
-    case 'or':
-      for (const child of node.children) visitOracleLeaves(child, visit, onWarning)
-      return
-    case 'not':
-      visitOracleLeaves(node.child, visit, onWarning)
-      return
-    case 'eq':
-    case 'lt':
-    case 'lte':
-    case 'gt':
-    case 'gte': {
-      const leftLeaf: PredicateLeaf = node.left
-      const rightLeaf: PredicateLeaf = node.right
-      const leftIsOracle = leftLeaf.kind === 'oracle_price'
-      const rightIsOracle = rightLeaf.kind === 'oracle_price'
-      let oracleAsset: string | undefined
-      let literal: bigint | undefined
-      if (leftIsOracle) {
-        oracleAsset = leftLeaf.asset
-        literal = oracleLiteralFromLeaf(rightLeaf)
-      } else if (rightIsOracle) {
-        oracleAsset = rightLeaf.asset
-        literal = oracleLiteralFromLeaf(leftLeaf)
-      }
-      if (oracleAsset === undefined || literal === undefined) {
-        // Two reasons the case cannot be normalised:
-        //   - neither side is an oracle leaf (visitor has nothing to do)
-        //   - oracle-on-right with a non-literal LHS (Rust dispatch would
-        //     hit UnsupportedNode; the TS model cannot build a permit ctx
-        //     for it)
-        // Only the second is a meaningful warning; the first is a no-op
-        // (the visitor was called for a non-oracle comparison). Emit the
-        // warning when an oracle IS present on one side but the other
-        // side is not a parseable threshold literal.
-        if (rightIsOracle) {
-          onWarning?.({
-            dimension: 'oracle_normalisation_dropped',
-            op: node.op,
-            asset: rightLeaf.kind === 'oracle_price' ? rightLeaf.asset : '',
-            otherKind: leftLeaf.kind,
-            message: `oracle-on-right cannot be normalised: the LHS (kind=${leftLeaf.kind}) is not an oracle_threshold literal; the Rust interpreter would surface UnsupportedNode here`,
-          })
-        }
-        return
-      }
-      visit(oracleAsset, node.op, literal)
-      return
-    }
-    case 'in':
-      // `in` is pure membership; oracle leaves inside haystacks are
-      // forbidden by the position rule, so there's nothing to set up here.
-      return
-  }
-}
-
-/** Restate an oracle threshold on the normalised 9-dp basis prices use.
- *  Thresholds carry their own basis, so reading the digits raw would build
- *  a permit context off by 10^(decimals-9) and the intended call would not
- *  satisfy its own bound. Mirrors NORMALISED_DECIMALS in oracle.rs. */
-function oracleLiteralFromLeaf(leaf: PredicateLeaf): bigint | undefined {
-  if (leaf.kind !== 'oracle_threshold') return undefined
-  let value: bigint
-  try {
-    value = BigInt(leaf.value)
-  } catch {
-    return undefined
-  }
-  const normalised = 9n
-  const decimals = BigInt(leaf.decimals)
-  if (decimals <= normalised) return value * 10n ** (normalised - decimals)
-  // Floor: a finer-grained threshold has no exact 9-dp representation; the
-  // caller offsets by one from here to land on the right side of the bound.
-  return value / 10n ** (decimals - normalised)
-}