@crediolabs/policy-synth 0.3.1 → 0.5.0

package/src/predicate/decode.ts

@@ -64,6 +64,15 @@ function expectSymbol(v: xdr.ScVal | undefined, what: string): string {
   return v.sym().toString()
 }
 
+/** Strict i128, returned as a decimal string. Strict on purpose: the Rust
+ *  decoder refuses a u32 in an i128 slot rather than widening it, so
+ *  accepting one here would let a predicate decode off chain and be refused
+ *  on chain. */
+function expectI128(v: xdr.ScVal | undefined, what: string): string {
+  if (!v || v.switch() !== xdr.ScValType.scvI128()) throw malformed(`${what} is not an i128`)
+  return scValToBigInt(v).toString()
+}
+
 /** Arity check with the same intent as the Rust `check_arity`: a selector with
  *  the wrong element count is malformed, not silently truncated. */
 function arity(items: xdr.ScVal[], n: number, selector: string): void {
@@ -94,6 +103,14 @@ function decodeSelectorLeaf(items: xdr.ScVal[], sym: string): PredicateLeaf {
         element: expectU32(items[2], 'call_arg_field element'),
         field: expectSymbol(items[3], 'call_arg_field field'),
       }
+    case 'call_arg_scaled':
+      arity(items, 4, sym)
+      return {
+        kind: 'call_arg_scaled',
+        index: expectU32(items[1], 'call_arg_scaled index'),
+        num: expectI128(items[2], 'call_arg_scaled num'),
+        den: expectI128(items[3], 'call_arg_scaled den'),
+      }
     default:
       // Deliberately NOT a literal_vec fallback - see the header note.
       throw malformed(`unknown selector symbol '${sym}'`)
@@ -129,14 +146,18 @@ export function decodeNode(v: xdr.ScVal): PredicateNode {
   const op = selectorSymbol(items)
   if (op === null) throw malformed('node does not start with an operator symbol')
   switch (op) {
-    case 'and': {
+    case 'and':
+    case 'or': {
       arity(items, 2, op)
       const children = expectVec(items[1] as xdr.ScVal, `${op} children`).map(decodeNode)
       if (children.length === 0) throw malformed(`${op} has no children`)
       return { op, children }
     }
     case 'eq':
+    case 'lt':
     case 'lte':
+    case 'gt':
+    case 'gte':
       arity(items, 3, op)
       return {
         op,

package/src/predicate/encode.ts

@@ -124,7 +124,8 @@ function walk(
   counters: { selectorLeaves: number }
 ): { depth: number; leaves: number } {
   switch (node.op) {
-    case 'and': {
+    case 'and':
+    case 'or': {
       if (node.children.length === 0) {
         throw capError(
           'MALFORMED_PREDICATE',
@@ -141,7 +142,10 @@ function walk(
       return { depth: maxChildDepth + 1, leaves: totalLeaves }
     }
     case 'eq':
-    case 'lte': {
+    case 'lt':
+    case 'lte':
+    case 'gt':
+    case 'gte': {
       collectSelector(node.left, counters)
       collectSelector(node.right, counters)
       return { depth: 1, leaves: leafCount(node.left) + leafCount(node.right) }
@@ -192,14 +196,20 @@ function collectSelector(leaf: PredicateLeaf, counters: { selectorLeaves: number
 
 function encodeNode(node: PredicateNode): xdr.ScVal {
   switch (node.op) {
-    case 'and': {
+    case 'and':
+    case 'or': {
       const encoded = node.children.map(encodeNode)
-      // sort children by their canonical XDR bytes ascending.
+      // sort children by their canonical XDR bytes ascending. Both operators
+      // are commutative for the permit decision, so sorting costs no meaning
+      // and buys a stable hash for logically-identical predicates.
       const sorted = sortByCanonicalBytes(encoded)
       return xdr.ScVal.scvVec([symbol(node.op), xdr.ScVal.scvVec(sorted)])
     }
     case 'eq':
-    case 'lte': {
+    case 'lt':
+    case 'lte':
+    case 'gt':
+    case 'gte': {
       return xdr.ScVal.scvVec([symbol(node.op), encodeLeaf(node.left), encodeLeaf(node.right)])
     }
     case 'in': {
@@ -231,6 +241,15 @@ function encodeLeaf(leaf: PredicateLeaf): xdr.ScVal {
         xdr.ScVal.scvU32(leaf.element),
         xdr.ScVal.scvSymbol(leaf.field),
       ])
+    case 'call_arg_scaled':
+      // num/den are i128 on the wire. The Rust decoder type-checks both
+      // slots, so a u32 here would be refused rather than widened.
+      return xdr.ScVal.scvVec([
+        symbol('call_arg_scaled'),
+        xdr.ScVal.scvU32(leaf.index),
+        scvI128FromDecimal(leaf.num),
+        scvI128FromDecimal(leaf.den),
+      ])
     case 'literal_address':
       return scvAddressFromStrkey(leaf.value)
     case 'literal_i128':
@@ -332,6 +351,33 @@ function validateLeafValues(node: PredicateNode): void {
           throw malformed(`call_arg_field.element out of u32 range at ${path}`)
         }
         return
+      case 'call_arg_scaled': {
+        if (!Number.isInteger(leaf.index) || leaf.index < 0 || leaf.index > U32_MAX) {
+          throw malformed(`call_arg_scaled.index out of u32 range at ${path}`)
+        }
+        // Mirror of the contract's install gate (214). Without it the TS
+        // self-verify would green-light a ratio the chain refuses, which is
+        // exactly the divergence this validator exists to prevent.
+        let num: bigint
+        let den: bigint
+        try {
+          num = BigInt(leaf.num)
+          den = BigInt(leaf.den)
+        } catch {
+          throw malformed(`call_arg_scaled num/den must be i128 decimal strings at ${path}`)
+        }
+        if (den === 0n) {
+          throw malformed(
+            `call_arg_scaled.den is zero at ${path}: the contract refuses it at install (INVALID_SCALED_RATIO)`
+          )
+        }
+        if (num <= 0n || den < 0n) {
+          throw malformed(
+            `call_arg_scaled ratio ${leaf.num}/${leaf.den} at ${path} is not positive: a negative ratio inverts the comparison, so the floor would permit what it was written to refuse. The contract refuses it at install (INVALID_SCALED_RATIO)`
+          )
+        }
+        return
+      }
       case 'call_contract':
       case 'call_fn':
       case 'literal_address':
@@ -342,12 +388,16 @@ function validateLeafValues(node: PredicateNode): void {
   function walkNode(n: PredicateNode, path: string): void {
     switch (n.op) {
       case 'and':
+      case 'or':
         n.children.forEach((c, i) => {
           walkNode(c, `${path}.children[${i}]`)
         })
         return
       case 'eq':
+      case 'lt':
       case 'lte':
+      case 'gt':
+      case 'gte':
         walkLeaf(n.left, `${path}.left`)
         walkLeaf(n.right, `${path}.right`)
         return

package/src/predicate/from-json.ts

@@ -26,9 +26,13 @@ export function jsonToAst(value: unknown): PredicateNode {
   }
   switch (v.op) {
     case 'and':
-      return { op: 'and', children: arrayOf(v.children, jsonToAst) }
+    case 'or':
+      return { op: v.op, children: arrayOf(v.children, jsonToAst) }
     case 'eq':
+    case 'lt':
     case 'lte':
+    case 'gt':
+    case 'gte':
       return { op: v.op, left: jsonToLeaf(v.left), right: jsonToLeaf(v.right) }
     case 'in':
       return { op: 'in', needle: jsonToLeaf(v.needle), haystack: arrayOf(v.haystack, jsonToLeaf) }
@@ -53,6 +57,15 @@ function jsonToLeaf(value: unknown): PredicateLeaf {
       return { kind: 'call_arg', index: numberField(v, 'index') }
     case 'call_arg_len':
       return { kind: 'call_arg_len', index: numberField(v, 'index') }
+    case 'call_arg_scaled':
+      // num/den stay decimal STRINGS: an i128 ratio does not survive a JS
+      // number, and silently rounding one would change the floor.
+      return {
+        kind: 'call_arg_scaled',
+        index: numberField(v, 'index'),
+        num: stringField(v, 'num'),
+        den: stringField(v, 'den'),
+      }
     case 'literal_address':
       return { kind: 'literal_address', value: stringField(v, 'value') }
     case 'literal_i128':

package/src/record/index.ts

@@ -17,8 +17,13 @@
 // Returns ToolResponse<RecordedTransaction> per the canonical envelope
 // defined in src/errors.ts.
 
-import type { xdr } from '@stellar/stellar-sdk'
+import { Networks, type xdr } from '@stellar/stellar-sdk'
 import type { ToolError, ToolResponse } from '../errors.ts'
+import {
+  resolveContractsByOnChainSpec,
+  type SpecFetcher,
+  specFetcherFromRpc,
+} from '../registry/on-chain-spec.ts'
 import type { Network, ParseConfidence, RecordedTransaction } from '../types.ts'
 import type { DecodedTransaction } from './decode.ts'
 import {
@@ -34,7 +39,7 @@ import {
   isBelowThreshold,
 } from './freshness.ts'
 import { extractTokenMovements } from './movements.ts'
-import { createRpcServer, type RpcFetcher } from './rpc.ts'
+import { createRpcServer, PUBLIC_RPC_URLS, type RpcFetcher } from './rpc.ts'
 import { validateAgainstEvents } from './validate.ts'
 
 /** Public input shape. The brief pins:
@@ -63,10 +68,56 @@ export interface RecordInput {
    *  automatically; tests can pass a deterministic stub. */
   crossNetworkFetcher?: RpcFetcher
   confidenceOverride?: number
+  /** Read a contract's own interface off chain when the compiled-in registry
+   *  does not recognise it. Default ON: the registry covers the protocols we
+   *  pinned by hand, and refusing everything else reported `no-abi` for
+   *  contracts that publish a full typed spec. Set false to record against
+   *  the registry alone (no extra RPC). */
+  resolveContractSpecs?: boolean
+  /** Test seam for the spec lookup. Unset in production, where it is built
+   *  from the network's pinned RPC URL. */
+  specFetcher?: SpecFetcher
 }
 
 export type RecordResult = ToolResponse<RecordedTransaction>
 
+/** Second pass over the contracts the compiled-in registry did not recognise.
+ *
+ *  Each candidate's own interface is read off chain and every call it received
+ *  is checked against it; the ones that verify are fed back through the decoder
+ *  as known. Re-decoding rather than patching the first result keeps ONE code
+ *  path computing parseConfidence - a hand-adjusted count here would be a
+ *  second implementation of the gate, free to drift from the real one.
+ *
+ *  Only ever ADDS recognition. A missing spec, an unreachable RPC or a call the
+ *  interface does not describe all leave the recording exactly as it was. */
+async function resolveByOnChainSpec(
+  input: RecordInput,
+  decoded: DecodedTransaction,
+  redecode: (known: ReadonlySet<string>) => DecodedTransaction
+): Promise<DecodedTransaction> {
+  if (input.resolveContractSpecs === false) return decoded
+  if (decoded.unknownContracts.length === 0) return decoded
+  const fetcher =
+    input.specFetcher ??
+    specFetcherFromRpc(
+      PUBLIC_RPC_URLS[input.network],
+      input.network === 'mainnet' ? Networks.PUBLIC : Networks.TESTNET
+    )
+  let resolved: ReadonlySet<string>
+  try {
+    resolved = await resolveContractsByOnChainSpec(
+      decoded.invocations,
+      decoded.unknownContracts.map((u) => u.contract),
+      fetcher
+    )
+  } catch {
+    // A lookup failure must not fail the recording that already succeeded.
+    return decoded
+  }
+  return resolved.size === 0 ? decoded : redecode(resolved)
+}
+
 export async function recordTransaction(input: RecordInput): Promise<RecordResult> {
   if (!input.network) {
     return err('RECORDING_FAILED', 'network required', false)
@@ -138,6 +189,9 @@ export async function recordTransaction(input: RecordInput): Promise<RecordResul
       if (e instanceof DecodeError) return err('RECORDING_FAILED', e.message, false)
       throw e
     }
+    decoded = await resolveByOnChainSpec(input, decoded, (known) =>
+      decodeEnvelope(fetched.envelopeXdr, events, [], fetched.ledger, known, input.network)
+    )
     return finish(input.network, decoded, input.confidenceOverride)
   }
 
@@ -157,6 +211,9 @@ export async function recordTransaction(input: RecordInput): Promise<RecordResul
       false
     )
   }
+  decoded = await resolveByOnChainSpec(input, decoded, (known) =>
+    decodeEnvelopeXdr(xdrStr, [], [], 0, known, input.network)
+  )
   return finish(input.network, decoded, input.confidenceOverride)
 }
 

package/src/record/rpc.ts

@@ -23,7 +23,10 @@ export interface SorobanTxResponse {
 
 export type RpcFetcher = (hash: string) => Promise<SorobanTxResponse | null>
 
-const PUBLIC_RPC_URLS: Record<Network, string> = {
+/** Exported so the on-chain spec lookup reads from the SAME endpoint the
+ *  recorder fetched the transaction from. Two different endpoints could
+ *  disagree about what a contract is. */
+export const PUBLIC_RPC_URLS: Record<Network, string> = {
   testnet: 'https://soroban-testnet.stellar.org',
   // The brief pins testnet; mainnet is left to the caller via injection. We keep
   // a public default that matches the brief's note ("e.g. https://mainnet.sorobanrpc.com").

package/src/registry/identify.ts

@@ -107,7 +107,10 @@ export function identifyProtocol(
  *  declared type. `other` is intentionally NOT a valid ABI match - it means
  *  the decoder couldn't classify the value, which is exactly the signal
  *  fail-closed should refuse. */
-function argsMatchAbi(expected: AbiArg[], actual: ScVal[]): boolean {
+/** Exported so the on-chain-spec path checks a call the SAME way a pinned
+ *  protocol does. Reimplementing it there would let the two drift, and a
+ *  looser copy would be the fail-OPEN direction. */
+export function argsMatchAbi(expected: AbiArg[], actual: ScVal[]): boolean {
   if (expected.length !== actual.length) return false
   for (let i = 0; i < expected.length; i += 1) {
     const want = expected[i]

package/src/registry/on-chain-spec.ts

@@ -0,0 +1,168 @@
+// src/registry/on-chain-spec.ts - read a contract's own interface off chain.
+//
+// The compiled-in registry covers the protocols we pinned by hand. Everything
+// else was reported as `no-abi`, which read as "this contract does not
+// describe itself" when it almost always does: a Soroban contract embeds a
+// typed spec in its wasm, and the network will hand it over. The recorder was
+// refusing calls whose interface was one RPC round-trip away.
+//
+// What this buys is NARROW and deliberately so. A fetched spec says what the
+// contract's arguments ARE, not what they MEAN. So a call verified against it
+// is recognised - the decode is trustworthy, the confidence gate stops
+// refusing it - but the arguments carry the contract's own parameter NAMES
+// rather than a curated meaning, and nothing here infers which argument is a
+// spend or a recipient. A pinned protocol still outranks a fetched spec for
+// exactly that reason, and `identifyProtocol` is consulted first.
+
+import { contract as sdkContract } from '@stellar/stellar-sdk'
+import type { ContractInvocation, ScVal } from '../types.ts'
+import { argsMatchAbi } from './identify.ts'
+import type { AbiArg, AbiArgType, ProtocolAbi } from './protocols.ts'
+
+/** Map an XDR spec type to the ScVal subset vocabulary the matcher uses.
+ *
+ *  Returns null for a type the recorder's ScVal subset cannot represent. That
+ *  is deliberate: an argument we cannot type is an argument we cannot check,
+ *  and claiming a match on it would be the fail-OPEN direction. A function
+ *  with any such argument is dropped from the derived ABI, so a call to it
+ *  stays unrecognised rather than being waved through. */
+export function abiTypeFromSpecType(specTypeName: string): AbiArgType | null {
+  switch (specTypeName) {
+    case 'scSpecTypeAddress':
+      return 'address'
+    case 'scSpecTypeI128':
+      return 'i128'
+    case 'scSpecTypeU64':
+    case 'scSpecTypeI64':
+      return 'u64'
+    case 'scSpecTypeU32':
+    case 'scSpecTypeI32':
+      return 'u32'
+    case 'scSpecTypeSymbol':
+      return 'symbol'
+    case 'scSpecTypeVec':
+      return 'vec'
+    case 'scSpecTypeBytes':
+    case 'scSpecTypeBytesN':
+      return 'bytes'
+    case 'scSpecTypeMap':
+      return 'map'
+    default:
+      return null
+  }
+}
+
+/** The RPC surface this module needs. Narrowed to one method so a test can
+ *  supply a stub without standing up a server, and so the recorder's existing
+ *  RPC client can be passed straight in. */
+export interface SpecFetcher {
+  contractSpec(contractId: string): Promise<sdkContract.Spec | null>
+}
+
+/** Build a `SpecFetcher` over the SDK's contract client. */
+export function specFetcherFromRpc(rpcUrl: string, networkPassphrase: string): SpecFetcher {
+  return {
+    async contractSpec(contractId: string): Promise<sdkContract.Spec | null> {
+      try {
+        const client = await sdkContract.Client.from({ contractId, networkPassphrase, rpcUrl })
+        return (client as unknown as { spec: sdkContract.Spec }).spec ?? null
+      } catch {
+        // A contract with no spec, an unreachable RPC and a bad address all
+        // land here and all mean the same thing to the caller: no interface
+        // was obtained, so the contract stays unrecognised. Fail closed.
+        return null
+      }
+    },
+  }
+}
+
+/** Convert a fetched spec into the ABI shape `identifyProtocol` already
+ *  matches against. Functions with an argument outside the ScVal subset are
+ *  OMITTED rather than partially typed. */
+export function abiFromSpec(spec: sdkContract.Spec): ProtocolAbi {
+  const abi: ProtocolAbi = {}
+  for (const fn of spec.funcs()) {
+    const name = fn.name().toString()
+    // The constructor is not callable after deployment, so a recorded
+    // invocation can never be one. Keeping it would only widen the surface.
+    if (name === '__constructor') continue
+    const args: AbiArg[] = []
+    let usable = true
+    for (const input of fn.inputs()) {
+      const type = abiTypeFromSpecType(input.type().switch().name)
+      if (type === null) {
+        usable = false
+        break
+      }
+      const argName = input.name().toString()
+      args.push({
+        name: argName,
+        type,
+        // The contract's own parameter name is the honest description. It is
+        // NOT a curated meaning - nothing here knows whether `value` is a
+        // spend - so downstream must not treat it as one.
+        meaning: `${argName} (from the contract's on-chain interface)`,
+      })
+    }
+    if (usable) abi[name] = { args }
+  }
+  return abi
+}
+
+/** Fetch and convert in one step. Returns null when no usable interface was
+ *  obtained, which the caller must treat as "unrecognised". */
+export async function fetchContractAbi(
+  contractId: string,
+  fetcher: SpecFetcher
+): Promise<ProtocolAbi | null> {
+  const spec = await fetcher.contractSpec(contractId)
+  if (spec === null) return null
+  const abi = abiFromSpec(spec)
+  return Object.keys(abi).length === 0 ? null : abi
+}
+
+/** Every contract invoked anywhere in the tree, with the calls made on it. */
+function callsByContract(
+  invocations: ReadonlyArray<ContractInvocation>
+): Map<string, Array<{ fn: string; args: ScVal[] }>> {
+  const out = new Map<string, Array<{ fn: string; args: ScVal[] }>>()
+  const walk = (inv: ContractInvocation): void => {
+    const list = out.get(inv.contract) ?? []
+    list.push({ fn: inv.fn, args: inv.args })
+    out.set(inv.contract, list)
+    for (const sub of inv.subInvocations) walk(sub)
+  }
+  for (const inv of invocations) walk(inv)
+  return out
+}
+
+/** Contracts whose EVERY recorded call matches their own published interface.
+ *
+ *  All-or-nothing per contract, deliberately. A contract where one call
+ *  verifies and another does not is a contract we do not understand, and
+ *  marking it recognised would raise confidence on the strength of the call
+ *  we happened to check. The unverified call is the one that matters.
+ *
+ *  A contract with no fetchable spec, or a call naming a function absent from
+ *  it, simply stays unknown - this only ever ADDS recognition, so a failure
+ *  here degrades to today's behaviour rather than to a wrong answer. */
+export async function resolveContractsByOnChainSpec(
+  invocations: ReadonlyArray<ContractInvocation>,
+  candidates: ReadonlyArray<string>,
+  fetcher: SpecFetcher
+): Promise<Set<string>> {
+  const resolved = new Set<string>()
+  const calls = callsByContract(invocations)
+  for (const contract of new Set(candidates)) {
+    const made = calls.get(contract)
+    if (!made || made.length === 0) continue
+    const abi = await fetchContractAbi(contract, fetcher)
+    if (abi === null) continue
+    const everyCallVerifies = made.every((c) => {
+      const entry = abi[c.fn]
+      return entry !== undefined && argsMatchAbi(entry.args, c.args)
+    })
+    if (everyCallVerifies) resolved.add(contract)
+  }
+  return resolved
+}

package/src/review-card/builder.ts

@@ -20,7 +20,7 @@
 // hash. There is no clock; the hash never includes a timestamp.
 
 import { createHash } from 'node:crypto'
-import type { ContextRuleDraft, PredicateNode } from '../types.ts'
+import type { ContextRuleDraft, PredicateLeaf, PredicateNode } from '../types.ts'
 import { comparisonOpText, renderHaystackElement, renderVecElement } from './render-leaf.ts'
 
 export interface ReviewCardSummary {
@@ -105,16 +105,33 @@ function walkPredicate(node: PredicateNode, visit: (node: PredicateNode) => void
     case 'and':
       for (const child of node.children) walkPredicate(child, visit)
       return
+    // NOT descended into. Every line the card emits reads as a requirement,
+    // and `and` is what makes that true. Listing an `or`'s branches as
+    // separate lines would state the opposite of what the policy means, so
+    // the whole disjunction is rendered as ONE line instead.
+    case 'or':
+      visit(node)
+      return
     case 'in':
       visit(node)
       return
     case 'eq':
+    case 'lt':
     case 'lte':
+    case 'gt':
+    case 'gte':
       visit(node)
       return
   }
 }
 
+/** Argument index of a `call_arg` leaf, for the scaled-comparison line. Any
+ *  other leaf renders as its kind so the line stays readable rather than
+ *  claiming an index that does not exist. */
+function leftArgLabel(leaf: PredicateLeaf): string {
+  return leaf.kind === 'call_arg' ? String(leaf.index) : `<${leaf.kind}>`
+}
+
 /** Render ONE constraint sentence for ONE interpreter predicate node. The
  *  shape of the output is pinned by Task 7b so the test suite can assert
  *  byte-for-byte equality. Returns `null` when the node is a structural
@@ -123,15 +140,41 @@ function renderConstraint(node: PredicateNode): string | null {
   switch (node.op) {
     case 'and':
       return null
+    case 'or': {
+      // One line for the whole disjunction. If any branch is a shape the
+      // card cannot render, the entire line is withheld rather than shown
+      // with a branch missing - a disjunction with a branch dropped reads
+      // as STRICTER than it is, which is the dangerous direction.
+      const parts = node.children.map(renderConstraint)
+      if (parts.some((p) => p === null)) return null
+      return `Either: ${parts.join(' OR ')}`
+    }
     case 'eq':
+    case 'lt':
     case 'lte':
+    case 'gt':
+    case 'gte':
       return renderComparison(node)
     case 'in':
       return renderMembership(node)
   }
 }
 
-function renderComparison(node: Extract<PredicateNode, { op: 'eq' | 'lte' }>): string | null {
+function renderComparison(
+  node: Extract<PredicateNode, { op: 'eq' | 'lt' | 'lte' | 'gt' | 'gte' }>
+): string | null {
+  // The slippage floor: OP(call_arg[out], call_arg_scaled(in, num, den)).
+  // Rendered explicitly because the human approving the signature has to see
+  // that the bound is a RATIO of another argument, not a fixed amount.
+  if (node.right.kind === 'call_arg_scaled') {
+    const s = node.right
+    return `arg[${leftArgLabel(node.left)}] ${comparisonOpText(node.op)} arg[${s.index}] * ${s.num}/${s.den}`
+  }
+  if (node.left.kind === 'call_arg_scaled') {
+    const s = node.left
+    return `arg[${s.index}] * ${s.num}/${s.den} ${comparisonOpText(node.op)} arg[${leftArgLabel(node.right)}]`
+  }
+
   const left = node.left
   const right = node.right
 

package/src/review-card/cross-check.ts

@@ -46,8 +46,28 @@ function collect(node: PredicateNode, out: string[]): void {
     case 'and':
       for (const child of node.children) collect(child, out)
       return
+    // ONE line for the whole disjunction, mirroring the builder. Emitting a
+    // line per branch would claim every branch is required, which is the
+    // opposite of what `or` means. If any branch renders to nothing the whole
+    // line is withheld, again mirroring the builder - a disjunction missing a
+    // branch reads STRICTER than it is.
+    case 'or': {
+      const parts: string[] = []
+      for (const child of node.children) {
+        const childOut: string[] = []
+        collect(child, childOut)
+        if (childOut.length !== 1) return
+        parts.push(childOut[0] as string)
+      }
+      if (parts.length === 0) return
+      out.push(`Either: ${parts.join(' OR ')}`)
+      return
+    }
     case 'eq':
+    case 'lt':
     case 'lte':
+    case 'gt':
+    case 'gte':
       pushComparison(node.left, node.right, node.op, out)
       return
     case 'in':
@@ -59,9 +79,23 @@ function collect(node: PredicateNode, out: string[]): void {
 function pushComparison(
   left: PredicateLeaf,
   right: PredicateLeaf,
-  op: 'eq' | 'lte',
+  op: 'eq' | 'lt' | 'lte' | 'gt' | 'gte',
   out: string[]
 ): void {
+  // Slippage floor, mirroring the builder. The human has to see that the
+  // bound is a RATIO of another argument, not a fixed amount.
+  if (right.kind === 'call_arg_scaled') {
+    const label = left.kind === 'call_arg' ? String(left.index) : `<${left.kind}>`
+    out.push(
+      `arg[${label}] ${comparisonOpText(op)} arg[${right.index}] * ${right.num}/${right.den}`
+    )
+    return
+  }
+  if (left.kind === 'call_arg_scaled') {
+    const label = right.kind === 'call_arg' ? String(right.index) : `<${right.kind}>`
+    out.push(`arg[${left.index}] * ${left.num}/${left.den} ${comparisonOpText(op)} arg[${label}]`)
+    return
+  }
   if (left.kind === 'call_contract' && op === 'eq' && right.kind === 'literal_address') {
     out.push(`Contract must be ${right.value}`)
     return

package/src/review-card/render-leaf.ts

@@ -23,6 +23,7 @@ export function renderVecElement(leaf: PredicateLeaf): string {
     case 'call_arg':
     case 'call_arg_len':
     case 'call_arg_field':
+    case 'call_arg_scaled':
       return `<${leaf.kind}>`
   }
 }
@@ -38,10 +39,16 @@ export function renderHaystackElement(leaf: PredicateLeaf): string {
   return `<${leaf.kind}>`
 }
 
-export function comparisonOpText(op: 'eq' | 'lte'): string {
+export function comparisonOpText(op: 'eq' | 'lt' | 'lte' | 'gt' | 'gte'): string {
   switch (op) {
+    case 'lt':
+      return '<'
     case 'lte':
       return '<='
+    case 'gt':
+      return '>'
+    case 'gte':
+      return '>='
     case 'eq':
       return '=='
   }