@crediolabs/policy-synth 0.3.1 → 0.5.0

package/src/run/index.ts

@@ -20,7 +20,9 @@
 import { createHash } from 'node:crypto'
 import { rpc } from '@stellar/stellar-sdk'
 import {
+  declarePredicate,
   type ErrorCode,
+  encodePredicate,
   type Network,
   type PredicateNode,
   type ProposedPolicy,
@@ -31,6 +33,11 @@ import {
   type ToolError,
   type ToolResponse,
 } from '../index.ts'
+import {
+  type AuthorityOverlap,
+  findAuthorityOverlaps,
+  type ObservedRule,
+} from '../install/authority-overlap.ts'
 import {
   type BuildInstallPolicyResult,
   type BuildRevokePolicyResult,
@@ -40,8 +47,11 @@ import {
   rpcClientFromServer,
 } from '../install/build-install-policy.ts'
 import { getInterpreterInfo } from '../install/get-interpreter-info.ts'
+import { accountRuleReaderFromServer, collectObservedRules } from '../install/read-account-rules.ts'
+import { decodePredicate } from '../predicate/decode.ts'
 import { type EvalContext, evaluate, generateCases } from '../simulate/index.ts'
 import {
+  DeclarePolicyInputSchema,
   type GetInterpreterInfoInput,
   GetInterpreterInfoInputSchema,
   type InstallPolicyInput,
@@ -64,6 +74,7 @@ import {
 } from './schemas.ts'
 
 export type {
+  DeclarePolicyInput,
   GetInterpreterInfoInput,
   InstallPolicyInput,
   RecordTransactionInput,
@@ -78,6 +89,7 @@ export type {
 // truth - MCP tool shapes are derived from them.
 export {
   ComposeUserResponsesSchema,
+  DeclarePolicyInputSchema,
   GetInterpreterInfoInputSchema,
   InstallPolicyInputSchema,
   InterpreterOptionsSchema,
@@ -107,6 +119,7 @@ export type RunVerifyPolicyInput = VerifyPolicyInput
 type RunToolName =
   | 'record_transaction'
   | 'synthesize_policy'
+  | 'declare_policy'
   | 'simulate_policy'
   | 'verify_policy'
   | 'install_policy'
@@ -119,6 +132,7 @@ type RunToolName =
 const TOOL_ERROR_CODE: Record<RunToolName, ErrorCode> = {
   record_transaction: 'RECORDING_FAILED',
   synthesize_policy: 'SYNTHESIS_ERROR',
+  declare_policy: 'SYNTHESIS_ERROR',
   simulate_policy: 'SIMULATION_ERROR',
   verify_policy: 'VERIFICATION_FAILED',
   install_policy: 'INSTALL_BUILD_FAILED',
@@ -203,7 +217,7 @@ export async function runSynthesizePolicy(raw: unknown): Promise<
 
 export async function runInstallPolicy(
   raw: unknown
-): Promise<ToolResponse<BuildInstallPolicyResult>> {
+): Promise<ToolResponse<BuildInstallPolicyResult & { authorityScan: AuthorityOverlap[] | null }>> {
   const parsed = InstallPolicyInputSchema.safeParse(raw)
   if (!parsed.success) {
     return { ok: false, error: validationError('install_policy', parsed.error.issues) }
@@ -254,7 +268,33 @@ export async function runInstallPolicy(
       rpc: rpcClient,
       ...(input.baseFee !== undefined ? { baseFee: input.baseFee } : {}),
     })
-    return { ok: true, data: result }
+    // Cross-rule scan. The caller may supply `existingRules` (useful offline,
+    // and for testing); otherwise the account is READ, so the answer describes
+    // what is actually installed rather than what the caller happened to
+    // mention.
+    //
+    // `null` means NOT CHECKED and is returned whenever the scan cannot be
+    // trusted to be complete - the read failed, or it stopped before
+    // accounting for every live rule. An empty list would say "checked,
+    // nothing found", and a partial scan that reported `[]` would be claiming
+    // a safety it never established.
+    const observed = await resolveExistingRules(input, network, expectedInterpreter)
+    const authorityScan =
+      observed === null
+        ? null
+        : findAuthorityOverlaps({
+            intended: {
+              // `add_context_rule` gets its id FROM the account, so there is
+              // no existing rule this install replaces. A sentinel no real id
+              // can equal keeps every observed rule in scope.
+              ruleId: -1,
+              contextType: input.rule.contextRuleType,
+              signers: input.rule.signers,
+              predicate: decodePredicate(encodedPredicate),
+            },
+            existing: observed,
+          })
+    return { ok: true, data: { ...result, authorityScan } }
   } catch (e) {
     return toolFailure('install_policy', e)
   }
@@ -384,6 +424,50 @@ export function runSimulatePolicy(raw: unknown): ToolResponse<{
   }
 }
 
+/** `declare_policy` body - the DECLARATIVE front-end.
+ *
+ *  `synthesize_policy` infers a predicate from a transaction that happened;
+ *  this takes the constraint stated outright. No RPC, no decoding and no
+ *  parseConfidence, so nothing here can be refused for a contract the registry
+ *  does not recognise - which is most of the point of having it.
+ *
+ *  The returned `warnings` are load-bearing, not decoration. An argument index
+ *  the caller did not supply is DEFAULTED to the SEP-41 position, and a bound
+ *  on the wrong argument constrains something the caller did not mean without
+ *  ever announcing itself, so a caller that ignores warnings can install a
+ *  predicate that reads correctly and binds nothing. */
+export function runDeclarePolicy(raw: unknown): ToolResponse<{
+  predicate: PredicateNode
+  encodedPredicate: string
+  predicateHash: string
+  warnings: string[]
+}> {
+  const parsed = DeclarePolicyInputSchema.safeParse(raw)
+  if (!parsed.success) {
+    return { ok: false, error: validationError('declare_policy', parsed.error.issues) }
+  }
+  try {
+    // Rebuilt field-by-field rather than passed through: the schema's
+    // optionals are `T | undefined` and `PolicyDeclaration`'s are absent-or-T,
+    // which `exactOptionalPropertyTypes` treats as different.
+    const d = parsed.data
+    const { predicate, warnings } = declarePredicate({
+      fn: d.fn,
+      ...(d.contract !== undefined ? { contract: d.contract } : {}),
+      ...(d.maxAmount !== undefined ? { maxAmount: d.maxAmount } : {}),
+      ...(d.amountArgIndex !== undefined ? { amountArgIndex: d.amountArgIndex } : {}),
+      ...(d.recipients !== undefined ? { recipients: d.recipients } : {}),
+      ...(d.recipientArgIndex !== undefined ? { recipientArgIndex: d.recipientArgIndex } : {}),
+      ...(d.allowZeroCap !== undefined ? { allowZeroCap: d.allowZeroCap } : {}),
+      ...(d.minOutputRatio !== undefined ? { minOutputRatio: d.minOutputRatio } : {}),
+    })
+    const { encodedPredicate, predicateHash } = encodePredicate(predicate)
+    return { ok: true, data: { predicate, encodedPredicate, predicateHash, warnings } }
+  } catch (e) {
+    return toolFailure('declare_policy', e)
+  }
+}
+
 /** `verify_policy` body - the permit case plus a generated deny case per
  *  dimension.
  *
@@ -483,6 +567,45 @@ export async function runGetInterpreterInfo(
  *  network, falling back to the pinned RPC for the network. The caller
  *  has already been gated against the pinned URL elsewhere, so the
  *  fallback here only ever picks from a finite, audited pair. */
+/** The account's other context rules, or `null` when they could not be
+ *  established completely.
+ *
+ *  Caller-supplied `existingRules` win: they let the scan run offline, and a
+ *  caller who passes them has said what to compare against. Otherwise the
+ *  account is read over RPC.
+ *
+ *  Every failure path returns `null` rather than a short list. A read that
+ *  threw, or one that stopped before accounting for every live rule, has not
+ *  ruled anything out - and reporting `[]` there would turn "we could not
+ *  check" into "there is nothing to worry about". */
+async function resolveExistingRules(
+  input: InstallPolicyInput,
+  network: Network,
+  interpreterAddress: string
+): Promise<ObservedRule[] | null> {
+  if (input.existingRules !== undefined) {
+    // The schema types `predicate` loosely (it is the shared
+    // PredicateNodeSchema); the shape is already validated.
+    return input.existingRules as ObservedRule[]
+  }
+  try {
+    const url = input.rpcUrl ?? RPC_URL_BY_NETWORK[network]
+    const server = new rpc.Server(url, { allowHttp: false })
+    const collected = await collectObservedRules({
+      reader: accountRuleReaderFromServer(server, NETWORK_PASSPHRASES[network]),
+      smartAccount: input.smartAccount,
+      interpreterAddress,
+    })
+    if (collected.incomplete) return null
+    return collected.rules
+  } catch {
+    // The install itself is unaffected: the scan is advisory, so a failed
+    // read must not block a policy the user asked for. It just cannot be
+    // reported as a clean scan.
+    return null
+  }
+}
+
 function buildRpcClientFromInput(
   urlOverride: string | undefined,
   network: Network

package/src/run/schemas.ts

@@ -201,6 +201,15 @@ export const PredicateLeafSchema: z.ZodType<unknown> = z.lazy(() =>
       element: z.number().int().nonnegative(),
       field: z.string(),
     }),
+    // num/den are i128 decimal strings, matching `literal_i128`. The regex
+    // is the boundary guard; the ratio's SIGN is checked at encode, where
+    // the message can explain that a negative ratio inverts the comparison.
+    z.object({
+      kind: z.literal('call_arg_scaled'),
+      index: z.number().int().nonnegative(),
+      num: z.string().regex(/^-?[0-9]+$/),
+      den: z.string().regex(/^-?[0-9]+$/),
+    }),
     z.object({ kind: z.literal('literal_address'), value: z.string() }),
     z.object({ kind: z.literal('literal_i128'), value: z.string().regex(/^-?[0-9]+$/) }),
     z.object({ kind: z.literal('literal_symbol'), value: z.string() }),
@@ -222,16 +231,32 @@ export const PredicateLeafSchema: z.ZodType<unknown> = z.lazy(() =>
 export const PredicateNodeSchema: z.ZodType<unknown> = z.lazy(() =>
   z.union([
     z.object({ op: z.literal('and'), children: z.array(PredicateNodeSchema) }),
+    z.object({ op: z.literal('or'), children: z.array(PredicateNodeSchema) }),
     z.object({
       op: z.literal('eq'),
       left: PredicateLeafSchema,
       right: PredicateLeafSchema,
     }),
+    z.object({
+      op: z.literal('lt'),
+      left: PredicateLeafSchema,
+      right: PredicateLeafSchema,
+    }),
     z.object({
       op: z.literal('lte'),
       left: PredicateLeafSchema,
       right: PredicateLeafSchema,
     }),
+    z.object({
+      op: z.literal('gt'),
+      left: PredicateLeafSchema,
+      right: PredicateLeafSchema,
+    }),
+    z.object({
+      op: z.literal('gte'),
+      left: PredicateLeafSchema,
+      right: PredicateLeafSchema,
+    }),
     z.object({
       op: z.literal('in'),
       needle: PredicateLeafSchema,
@@ -281,6 +306,29 @@ export type VerifyPolicyInput = z.infer<typeof VerifyPolicyInputSchema>
 const MAX_SIGNERS_PER_RULE = 15
 const MAX_POLICIES_PER_RULE = 5
 
+const SignerDraftSchema = z.discriminatedUnion('kind', [
+  z.object({ kind: z.literal('delegated'), address: z.string() }),
+  z.object({ kind: z.literal('external'), verifier: z.string(), keyBytes: z.string() }),
+])
+
+const ContextTypeSchema = z.discriminatedUnion('kind', [
+  z.object({ kind: z.literal('default') }),
+  z.object({ kind: z.literal('call_contract'), contract: z.string() }),
+  z.object({ kind: z.literal('create_contract'), wasmHash: z.string() }),
+])
+
+/** A rule ALREADY on the account, as the caller observed it. Supplying these
+ *  turns on the cross-rule authority scan: a signer belonging to several rules
+ *  picks which one applies, so a predicate only constrains a key when the
+ *  policed rule is the only rule that key is on. */
+export const ObservedRuleSchema = z.object({
+  id: z.number().int().nonnegative(),
+  contextType: ContextTypeSchema,
+  signers: z.array(SignerDraftSchema),
+  policyAddresses: z.array(z.string()),
+  predicate: PredicateNodeSchema.optional(),
+})
+
 const ContextRuleDraftSchema = z
   .object({
     contextRuleType: z.discriminatedUnion('kind', [
@@ -325,12 +373,12 @@ const ContextRuleDraftSchema = z
 /** Pinned interpreter address (testnet).
  *  Single source for the MCP layer; do not embed elsewhere. */
 export const PINNED_INTERPRETER_TESTNET_ADDRESS =
-  'CCL336TCK2Y5OFNRCMN2M3HVPBCEX4PW5H6EQ5VW5NPMXOCP4ESB5XR4'
+  'CCBHVZ6HGGV7C4SNHCZ3S5665Z2WEMHTMBAEPO4XW6PKON464BEBANU5'
 
-/** Pinned interpreter address (mainnet), redeployed 2026-08-22 from a reproducible build. The mainnet
+/** Pinned interpreter address (mainnet), redeployed 2026-08-22 for grammar 4, from a reproducible build. The mainnet
  *  interpreter IS the binary exercised on testnet - both instances were created
  *  from the same uploaded wasm hash (see PINNED_INTERPRETER_WASM_SHA256), and
- *  both were read back with `grammar_version()` returning 3. The address differs
+ *  both were read back with `grammar_version()` returning 4. The address differs
  *  because instance ids are network-scoped. UNAUDITED at the time of writing.
  *
  *  These four constants move together or not at all. The grammar version and
@@ -338,15 +386,15 @@ export const PINNED_INTERPRETER_TESTNET_ADDRESS =
  *  alone would have the builder emit a version the other network refuses - with
  *  a green test run, since `grammar-version-parity.test.ts` would then pass. */
 export const PINNED_INTERPRETER_MAINNET_ADDRESS =
-  'CBZXLSTQUITBFZHQH6XRXF3XIVRQR4RHRI64Q5WELS5KGY3ZKJPFWDPF'
+  'CDN755TDYZM3ZQ5OXTJ6TIBUBWZV2KRI2BYJPBXD2MVWED4STT3VBN52'
 
 /** Pinned interpreter wasm sha256 (hex). */
 export const PINNED_INTERPRETER_WASM_SHA256 =
-  'a2b36e8ac5a61caf3757af26aa79e83f2995b451099f44772383806a55fe3414'
+  'b5ba1e35ccf20cd8c13c3a2c3098bf337033a92bcaf475d63c03ddc0cba0fcae'
 
 /** The grammar version the interpreter enforces (matches SELF_VERSION in
  *  contracts/policy-interpreter/src/version.rs). */
-export const PINNED_INTERPRETER_GRAMMAR_VERSION = 3
+export const PINNED_INTERPRETER_GRAMMAR_VERSION = 4
 
 /** Default Soroban RPC for the install / revoke / info tools. The recorder
  *  keeps its own copy in record/rpc.ts because it hands back a fetcher rather
@@ -391,8 +439,54 @@ export const NETWORK_PASSPHRASES: Record<Network, string> = {
 const STELLAR_CONTRACT_ADDRESS = /^C[2-7A-Z]{55}$/
 const STELLAR_ACCOUNT_ADDRESS = /^G[2-7A-Z]{55}$/
 
+// ===== declare_policy =====
+//
+// The declarative front-end: the constraint stated outright, with no
+// transaction to decode. Deliberately NOT a revival of the removed
+// `MandateSpec` - that carried a rolling `spendingLimit` the interpreter
+// cannot evaluate and an `approvalThreshold` needing OZ primitives nobody
+// deployed. Only fields grammar 3 can actually enforce appear here.
+export const DeclarePolicyInputSchema = z
+  .object({
+    fn: z.string().min(1, 'fn must name the method to pin'),
+    contract: z
+      .string()
+      .regex(STELLAR_CONTRACT_ADDRESS, 'contract must be a Stellar contract address (C...)')
+      .optional(),
+    /** Smallest unit, unsigned decimal STRING - an i128 is wider than
+     *  Number.MAX_SAFE_INTEGER, so a number here would silently round. */
+    maxAmount: z
+      .string()
+      .regex(/^[0-9]+$/, 'maxAmount must be an unsigned integer in the smallest unit')
+      .optional(),
+    amountArgIndex: z.number().int().nonnegative().max(U32_MAX).optional(),
+    recipients: z.array(z.string()).min(1, 'recipients must not be empty').optional(),
+    recipientArgIndex: z.number().int().nonnegative().max(U32_MAX).optional(),
+    allowZeroCap: z.boolean().optional(),
+    /** Minimum output as a ratio of the call's own input. num/den are decimal
+     *  STRINGS for the same reason maxAmount is: an i128 ratio does not
+     *  survive a JS number. */
+    minOutputRatio: z
+      .object({
+        num: z.string().regex(/^[0-9]+$/, 'num must be an unsigned integer'),
+        den: z.string().regex(/^[0-9]+$/, 'den must be an unsigned integer'),
+        inputArgIndex: z.number().int().nonnegative().max(U32_MAX),
+        outputArgIndex: z.number().int().nonnegative().max(U32_MAX),
+      })
+      .strict()
+      .optional(),
+  })
+  .strict()
+export type DeclarePolicyInput = z.infer<typeof DeclarePolicyInputSchema>
+
 export const InstallPolicyInputSchema = z
   .object({
+    /** Rules already on the account. Supplying them turns on the cross-rule
+     *  authority scan, which reports every existing rule a signer of this
+     *  install could name INSTEAD - including an unpoliced one, against which
+     *  the predicate never runs. Absent means the scan is skipped, and the
+     *  result says so rather than reporting "no overlaps found". */
+    existingRules: z.array(ObservedRuleSchema).optional(),
     /** The smart account contract address (C...) that will receive the rule. */
     smartAccount: z
       .string()

package/src/simulate/deny-cases.ts

@@ -24,7 +24,7 @@ export interface GeneratedCases {
  *  the wrong reason. */
 const OTHER_CONTRACT = Address.contract(Buffer.alloc(32, 0x5a)).toString()
 
-type ComparisonOperator = 'eq' | 'lte'
+type ComparisonOperator = 'eq' | 'lt' | 'lte' | 'gt' | 'gte'
 
 type ComparisonNode = {
   op: ComparisonOperator
@@ -248,11 +248,22 @@ function visit(node: PredicateNode, facts: PredicateFacts): void {
     case 'and':
       for (const child of node.children) visit(child, facts)
       return
+    // NOT descended into. A deny case works by violating ONE constraint and
+    // asserting the predicate refuses the call. Violating one branch of an
+    // `or` proves nothing, because another branch can still permit, so the
+    // generated case would either fail or pass for the wrong reason. A sound
+    // deny case for a disjunction must violate EVERY branch at once, which
+    // this generator does not construct - so it emits none.
+    case 'or':
+      return
     case 'in':
       facts.memberships.push(node)
       return
     case 'eq':
+    case 'lt':
     case 'lte':
+    case 'gt':
+    case 'gte':
       facts.comparisons.push(node)
   }
 }

package/src/simulate/evaluate.ts

@@ -1,4 +1,4 @@
-// src/simulate/evaluate.ts - TypeScript reference evaluator for grammar version 3.
+// src/simulate/evaluate.ts - TypeScript reference evaluator for grammar version 4.
 //
 // Pure function. Determinism: same `(predicate, ctx)` -> byte-identical result,
 // no clock, no randomness. Deny order (deny on FIRST violation, stable reason):
@@ -8,12 +8,13 @@
 //   3. `in` membership; empty haystack ALWAYS denies         -> 'NOT_IN_ALLOWLIST'
 //   4. otherwise permit.
 //
-// Grammar version 3 nodes: and, eq, lte
-// Grammar version 3 leaves: call_contract, call_fn, call_arg(i),
+// Grammar version 4 nodes: and, or, eq, lt, lte, gt, gte, in
+// Grammar version 4 leaves: call_contract, call_fn, call_arg(i),
 //   call_arg_len(i), call_arg_field(i, element, field),
+//   call_arg_scaled(i, num, den),
 //   literal_address, literal_i128, literal_symbol, literal_u32, literal_vec
-// Grammar version 3 deny reasons: ARG_MISMATCH, CONTRACT_SCOPE,
-//   UNSUPPORTED_NODE, NOT_IN_ALLOWLIST
+// Grammar version 4 deny reasons: ARG_MISMATCH, CONTRACT_SCOPE,
+//   ARITHMETIC_OVERFLOW, UNSUPPORTED_NODE, NOT_IN_ALLOWLIST, SLIPPAGE_FLOOR
 
 import type { PredicateLeaf, PredicateNode, ScVal } from '../types.ts'
 
@@ -28,6 +29,9 @@ export interface EvalContext {
 
 export type EvalResult = { permit: true } | { permit: false; reason: string }
 
+/** The comparison operators grammar 4 carries. */
+type CompareOpName = 'eq' | 'lt' | 'lte' | 'gt' | 'gte'
+
 /** Evaluate a `PredicateNode` against the candidate call described by `ctx`.
  *  Pure function. Returns `{ permit: true }` or `{ permit: false; reason }`. */
 export function evaluate(predicate: PredicateNode, ctx: EvalContext): EvalResult {
@@ -47,8 +51,23 @@ function walk(node: PredicateNode, ctx: EvalContext): EvalResult {
       }
       return lastDeny ?? { permit: true }
     }
+    // Permits on the first branch that holds; when none does, reports the
+    // FIRST branch's reason. Mirrors `Node::Or` in the Rust evaluator, which
+    // the conformance suite pins.
+    case 'or': {
+      let firstDeny: EvalResult | null = null
+      for (const child of node.children) {
+        const r = walk(child, ctx)
+        if (r.permit) return r
+        if (firstDeny === null) firstDeny = r
+      }
+      return firstDeny ?? { permit: false, reason: 'UNSUPPORTED_NODE' }
+    }
     case 'eq':
+    case 'lt':
     case 'lte':
+    case 'gt':
+    case 'gte':
       return evalCompare(node.op, node.left, node.right, ctx)
     case 'in':
       return evalIn(node.needle, node.haystack, ctx)
@@ -57,11 +76,22 @@ function walk(node: PredicateNode, ctx: EvalContext): EvalResult {
 
 /** Comparison leaf evaluation. */
 function evalCompare(
-  op: 'eq' | 'lte',
+  op: CompareOpName,
   left: PredicateLeaf,
   right: PredicateLeaf,
   ctx: EvalContext
 ): EvalResult {
+  // Scaled operands first, so the dedicated reasons reach the caller instead
+  // of a generic mismatch. Right-hand dispatch leads because
+  // `out >= in * num / den` is the canonical swap form. Mirrors the order in
+  // `eval_compare` on the Rust side.
+  if (right.kind === 'call_arg_scaled') {
+    return evalScaledCompare(op, left, right, true, ctx)
+  }
+  if (left.kind === 'call_arg_scaled') {
+    return evalScaledCompare(op, right, left, false, ctx)
+  }
+
   // CONTRACT_SCOPE on call_contract eq
   if (left.kind === 'call_contract' && op === 'eq') {
     if (right.kind !== 'literal_address') return { permit: false, reason: 'CONTRACT_SCOPE' }
@@ -112,10 +142,66 @@ function evalCompare(
   return { permit: false, reason: 'UNSUPPORTED_NODE' }
 }
 
+/** i128 bounds. The contract computes in i128 and denies on overflow, so the
+ *  reference has to draw the same line or the two layers disagree on inputs
+ *  near the boundary. */
+const I128_MIN = -(2n ** 127n)
+const I128_MAX = 2n ** 127n - 1n
+
+/** Comparison where one side is `call_arg_scaled`. Mirrors
+ *  `eval_scaled_arg_compare`: `args[index] * num / den` truncating toward
+ *  zero, ARITHMETIC_OVERFLOW on arithmetic that does not fit or a zero
+ *  denominator, SLIPPAGE_FLOOR on a comparison that simply fails. */
+function evalScaledCompare(
+  op: CompareOpName,
+  other: PredicateLeaf,
+  scaled: Extract<PredicateLeaf, { kind: 'call_arg_scaled' }>,
+  scaledOnRight: boolean,
+  ctx: EvalContext
+): EvalResult {
+  // Chaining two computed operands has no meaning a review card could state.
+  if (other.kind === 'call_arg_scaled') return { permit: false, reason: 'UNSUPPORTED_NODE' }
+
+  // Could not READ the operand is a different failure from read-and-missed.
+  const input = argNumericBigInt(ctx.args[scaled.index])
+  if (input === null) return { permit: false, reason: 'ARG_MISMATCH' }
+
+  let num: bigint
+  let den: bigint
+  try {
+    num = BigInt(scaled.num)
+    den = BigInt(scaled.den)
+  } catch {
+    return { permit: false, reason: 'ARG_MISMATCH' }
+  }
+  if (den === 0n) return { permit: false, reason: 'ARITHMETIC_OVERFLOW' }
+
+  const product = input * num
+  if (product < I128_MIN || product > I128_MAX) {
+    return { permit: false, reason: 'ARITHMETIC_OVERFLOW' }
+  }
+  // BigInt division already truncates toward zero, matching i128 semantics.
+  const quotient = product / den
+  if (quotient < I128_MIN || quotient > I128_MAX) {
+    return { permit: false, reason: 'ARITHMETIC_OVERFLOW' }
+  }
+
+  const otherVal =
+    other.kind === 'call_arg'
+      ? argNumericBigInt(ctx.args[other.index])
+      : literalNumericBigInt(other)
+  if (otherVal === null) return { permit: false, reason: 'ARG_MISMATCH' }
+
+  const [a, b] = scaledOnRight ? [otherVal, quotient] : [quotient, otherVal]
+  return bigintCmp(op, a.toString(), b.toString())
+    ? { permit: true }
+    : { permit: false, reason: 'SLIPPAGE_FLOOR' }
+}
+
 /** Per-ScVal equality. Handles literal_vec as an EXACT ordered sequence:
  *  compare element-by-element in order; deny if length or any element differs.
  *  Opaque args (`type: 'other'`) fail closed. */
-function evalArgEq(op: 'eq' | 'lte', actual: ScVal | undefined, right: PredicateLeaf): EvalResult {
+function evalArgEq(op: CompareOpName, actual: ScVal | undefined, right: PredicateLeaf): EvalResult {
   // eq(call_arg[i], literal_vec) -> EXACT ordered vector equality.
   if (op === 'eq' && right.kind === 'literal_vec') {
     if (actual?.type !== 'vec') return { permit: false, reason: 'ARG_MISMATCH' }
@@ -163,7 +249,7 @@ function evalArgEq(op: 'eq' | 'lte', actual: ScVal | undefined, right: Predicate
  *  to a numeric literal via BigInt. A non-numeric arg or a non-numeric literal
  *  fails closed (ARG_MISMATCH) rather than permitting an undecidable bound. */
 function evalArgOrderedCompare(
-  op: 'eq' | 'lte',
+  op: CompareOpName,
   actual: ScVal | undefined,
   right: PredicateLeaf
 ): EvalResult {
@@ -272,13 +358,19 @@ function resolveLeaf(leaf: PredicateLeaf, ctx: EvalContext): ScVal | undefined {
 }
 
 /** BigInt compare helper. */
-function bigintCmp(op: 'eq' | 'lte', aStr: string, bStr: string): boolean {
+function bigintCmp(op: CompareOpName, aStr: string, bStr: string): boolean {
   const a = BigInt(aStr)
   const b = BigInt(bStr)
   switch (op) {
     case 'eq':
       return a === b
+    case 'lt':
+      return a < b
     case 'lte':
       return a <= b
+    case 'gt':
+      return a > b
+    case 'gte':
+      return a >= b
   }
 }