@crediolabs/policy-synth 0.4.0 → 0.5.0

package/src/review-card/builder.ts

@@ -20,7 +20,7 @@
 // hash. There is no clock; the hash never includes a timestamp.
 
 import { createHash } from 'node:crypto'
-import type { ContextRuleDraft, PredicateNode } from '../types.ts'
+import type { ContextRuleDraft, PredicateLeaf, PredicateNode } from '../types.ts'
 import { comparisonOpText, renderHaystackElement, renderVecElement } from './render-leaf.ts'
 
 export interface ReviewCardSummary {
@@ -105,16 +105,33 @@ function walkPredicate(node: PredicateNode, visit: (node: PredicateNode) => void
     case 'and':
       for (const child of node.children) walkPredicate(child, visit)
       return
+    // NOT descended into. Every line the card emits reads as a requirement,
+    // and `and` is what makes that true. Listing an `or`'s branches as
+    // separate lines would state the opposite of what the policy means, so
+    // the whole disjunction is rendered as ONE line instead.
+    case 'or':
+      visit(node)
+      return
     case 'in':
       visit(node)
       return
     case 'eq':
+    case 'lt':
     case 'lte':
+    case 'gt':
+    case 'gte':
       visit(node)
       return
   }
 }
 
+/** Argument index of a `call_arg` leaf, for the scaled-comparison line. Any
+ *  other leaf renders as its kind so the line stays readable rather than
+ *  claiming an index that does not exist. */
+function leftArgLabel(leaf: PredicateLeaf): string {
+  return leaf.kind === 'call_arg' ? String(leaf.index) : `<${leaf.kind}>`
+}
+
 /** Render ONE constraint sentence for ONE interpreter predicate node. The
  *  shape of the output is pinned by Task 7b so the test suite can assert
  *  byte-for-byte equality. Returns `null` when the node is a structural
@@ -123,15 +140,41 @@ function renderConstraint(node: PredicateNode): string | null {
   switch (node.op) {
     case 'and':
       return null
+    case 'or': {
+      // One line for the whole disjunction. If any branch is a shape the
+      // card cannot render, the entire line is withheld rather than shown
+      // with a branch missing - a disjunction with a branch dropped reads
+      // as STRICTER than it is, which is the dangerous direction.
+      const parts = node.children.map(renderConstraint)
+      if (parts.some((p) => p === null)) return null
+      return `Either: ${parts.join(' OR ')}`
+    }
     case 'eq':
+    case 'lt':
     case 'lte':
+    case 'gt':
+    case 'gte':
       return renderComparison(node)
     case 'in':
       return renderMembership(node)
   }
 }
 
-function renderComparison(node: Extract<PredicateNode, { op: 'eq' | 'lte' }>): string | null {
+function renderComparison(
+  node: Extract<PredicateNode, { op: 'eq' | 'lt' | 'lte' | 'gt' | 'gte' }>
+): string | null {
+  // The slippage floor: OP(call_arg[out], call_arg_scaled(in, num, den)).
+  // Rendered explicitly because the human approving the signature has to see
+  // that the bound is a RATIO of another argument, not a fixed amount.
+  if (node.right.kind === 'call_arg_scaled') {
+    const s = node.right
+    return `arg[${leftArgLabel(node.left)}] ${comparisonOpText(node.op)} arg[${s.index}] * ${s.num}/${s.den}`
+  }
+  if (node.left.kind === 'call_arg_scaled') {
+    const s = node.left
+    return `arg[${s.index}] * ${s.num}/${s.den} ${comparisonOpText(node.op)} arg[${leftArgLabel(node.right)}]`
+  }
+
   const left = node.left
   const right = node.right
 

package/src/review-card/cross-check.ts

@@ -46,8 +46,28 @@ function collect(node: PredicateNode, out: string[]): void {
     case 'and':
       for (const child of node.children) collect(child, out)
       return
+    // ONE line for the whole disjunction, mirroring the builder. Emitting a
+    // line per branch would claim every branch is required, which is the
+    // opposite of what `or` means. If any branch renders to nothing the whole
+    // line is withheld, again mirroring the builder - a disjunction missing a
+    // branch reads STRICTER than it is.
+    case 'or': {
+      const parts: string[] = []
+      for (const child of node.children) {
+        const childOut: string[] = []
+        collect(child, childOut)
+        if (childOut.length !== 1) return
+        parts.push(childOut[0] as string)
+      }
+      if (parts.length === 0) return
+      out.push(`Either: ${parts.join(' OR ')}`)
+      return
+    }
     case 'eq':
+    case 'lt':
     case 'lte':
+    case 'gt':
+    case 'gte':
       pushComparison(node.left, node.right, node.op, out)
       return
     case 'in':
@@ -59,9 +79,23 @@ function collect(node: PredicateNode, out: string[]): void {
 function pushComparison(
   left: PredicateLeaf,
   right: PredicateLeaf,
-  op: 'eq' | 'lte',
+  op: 'eq' | 'lt' | 'lte' | 'gt' | 'gte',
   out: string[]
 ): void {
+  // Slippage floor, mirroring the builder. The human has to see that the
+  // bound is a RATIO of another argument, not a fixed amount.
+  if (right.kind === 'call_arg_scaled') {
+    const label = left.kind === 'call_arg' ? String(left.index) : `<${left.kind}>`
+    out.push(
+      `arg[${label}] ${comparisonOpText(op)} arg[${right.index}] * ${right.num}/${right.den}`
+    )
+    return
+  }
+  if (left.kind === 'call_arg_scaled') {
+    const label = right.kind === 'call_arg' ? String(right.index) : `<${right.kind}>`
+    out.push(`arg[${left.index}] * ${left.num}/${left.den} ${comparisonOpText(op)} arg[${label}]`)
+    return
+  }
   if (left.kind === 'call_contract' && op === 'eq' && right.kind === 'literal_address') {
     out.push(`Contract must be ${right.value}`)
     return

package/src/review-card/render-leaf.ts

@@ -23,6 +23,7 @@ export function renderVecElement(leaf: PredicateLeaf): string {
     case 'call_arg':
     case 'call_arg_len':
     case 'call_arg_field':
+    case 'call_arg_scaled':
       return `<${leaf.kind}>`
   }
 }
@@ -38,10 +39,16 @@ export function renderHaystackElement(leaf: PredicateLeaf): string {
   return `<${leaf.kind}>`
 }
 
-export function comparisonOpText(op: 'eq' | 'lte'): string {
+export function comparisonOpText(op: 'eq' | 'lt' | 'lte' | 'gt' | 'gte'): string {
   switch (op) {
+    case 'lt':
+      return '<'
     case 'lte':
       return '<='
+    case 'gt':
+      return '>'
+    case 'gte':
+      return '>='
     case 'eq':
       return '=='
   }

package/src/run/index.ts

@@ -47,6 +47,7 @@ import {
   rpcClientFromServer,
 } from '../install/build-install-policy.ts'
 import { getInterpreterInfo } from '../install/get-interpreter-info.ts'
+import { accountRuleReaderFromServer, collectObservedRules } from '../install/read-account-rules.ts'
 import { decodePredicate } from '../predicate/decode.ts'
 import { type EvalContext, evaluate, generateCases } from '../simulate/index.ts'
 import {
@@ -267,12 +268,19 @@ export async function runInstallPolicy(
       rpc: rpcClient,
       ...(input.baseFee !== undefined ? { baseFee: input.baseFee } : {}),
     })
-    // Cross-rule scan, when the caller supplied what else is on the account.
-    // ABSENT is reported as `null` rather than an empty list: "we did not
-    // look" and "we looked and found nothing" are different answers, and
-    // collapsing them would let a caller read silence as safety.
+    // Cross-rule scan. The caller may supply `existingRules` (useful offline,
+    // and for testing); otherwise the account is READ, so the answer describes
+    // what is actually installed rather than what the caller happened to
+    // mention.
+    //
+    // `null` means NOT CHECKED and is returned whenever the scan cannot be
+    // trusted to be complete - the read failed, or it stopped before
+    // accounting for every live rule. An empty list would say "checked,
+    // nothing found", and a partial scan that reported `[]` would be claiming
+    // a safety it never established.
+    const observed = await resolveExistingRules(input, network, expectedInterpreter)
     const authorityScan =
-      input.existingRules === undefined
+      observed === null
         ? null
         : findAuthorityOverlaps({
             intended: {
@@ -284,9 +292,7 @@ export async function runInstallPolicy(
               signers: input.rule.signers,
               predicate: decodePredicate(encodedPredicate),
             },
-            // The schema types `predicate` loosely (it is the shared
-            // PredicateNodeSchema); the shape is already validated.
-            existing: input.existingRules as ObservedRule[],
+            existing: observed,
           })
     return { ok: true, data: { ...result, authorityScan } }
   } catch (e) {
@@ -453,6 +459,7 @@ export function runDeclarePolicy(raw: unknown): ToolResponse<{
       ...(d.recipients !== undefined ? { recipients: d.recipients } : {}),
       ...(d.recipientArgIndex !== undefined ? { recipientArgIndex: d.recipientArgIndex } : {}),
       ...(d.allowZeroCap !== undefined ? { allowZeroCap: d.allowZeroCap } : {}),
+      ...(d.minOutputRatio !== undefined ? { minOutputRatio: d.minOutputRatio } : {}),
     })
     const { encodedPredicate, predicateHash } = encodePredicate(predicate)
     return { ok: true, data: { predicate, encodedPredicate, predicateHash, warnings } }
@@ -560,6 +567,45 @@ export async function runGetInterpreterInfo(
  *  network, falling back to the pinned RPC for the network. The caller
  *  has already been gated against the pinned URL elsewhere, so the
  *  fallback here only ever picks from a finite, audited pair. */
+/** The account's other context rules, or `null` when they could not be
+ *  established completely.
+ *
+ *  Caller-supplied `existingRules` win: they let the scan run offline, and a
+ *  caller who passes them has said what to compare against. Otherwise the
+ *  account is read over RPC.
+ *
+ *  Every failure path returns `null` rather than a short list. A read that
+ *  threw, or one that stopped before accounting for every live rule, has not
+ *  ruled anything out - and reporting `[]` there would turn "we could not
+ *  check" into "there is nothing to worry about". */
+async function resolveExistingRules(
+  input: InstallPolicyInput,
+  network: Network,
+  interpreterAddress: string
+): Promise<ObservedRule[] | null> {
+  if (input.existingRules !== undefined) {
+    // The schema types `predicate` loosely (it is the shared
+    // PredicateNodeSchema); the shape is already validated.
+    return input.existingRules as ObservedRule[]
+  }
+  try {
+    const url = input.rpcUrl ?? RPC_URL_BY_NETWORK[network]
+    const server = new rpc.Server(url, { allowHttp: false })
+    const collected = await collectObservedRules({
+      reader: accountRuleReaderFromServer(server, NETWORK_PASSPHRASES[network]),
+      smartAccount: input.smartAccount,
+      interpreterAddress,
+    })
+    if (collected.incomplete) return null
+    return collected.rules
+  } catch {
+    // The install itself is unaffected: the scan is advisory, so a failed
+    // read must not block a policy the user asked for. It just cannot be
+    // reported as a clean scan.
+    return null
+  }
+}
+
 function buildRpcClientFromInput(
   urlOverride: string | undefined,
   network: Network

package/src/run/schemas.ts

@@ -201,6 +201,15 @@ export const PredicateLeafSchema: z.ZodType<unknown> = z.lazy(() =>
       element: z.number().int().nonnegative(),
       field: z.string(),
     }),
+    // num/den are i128 decimal strings, matching `literal_i128`. The regex
+    // is the boundary guard; the ratio's SIGN is checked at encode, where
+    // the message can explain that a negative ratio inverts the comparison.
+    z.object({
+      kind: z.literal('call_arg_scaled'),
+      index: z.number().int().nonnegative(),
+      num: z.string().regex(/^-?[0-9]+$/),
+      den: z.string().regex(/^-?[0-9]+$/),
+    }),
     z.object({ kind: z.literal('literal_address'), value: z.string() }),
     z.object({ kind: z.literal('literal_i128'), value: z.string().regex(/^-?[0-9]+$/) }),
     z.object({ kind: z.literal('literal_symbol'), value: z.string() }),
@@ -222,16 +231,32 @@ export const PredicateLeafSchema: z.ZodType<unknown> = z.lazy(() =>
 export const PredicateNodeSchema: z.ZodType<unknown> = z.lazy(() =>
   z.union([
     z.object({ op: z.literal('and'), children: z.array(PredicateNodeSchema) }),
+    z.object({ op: z.literal('or'), children: z.array(PredicateNodeSchema) }),
     z.object({
       op: z.literal('eq'),
       left: PredicateLeafSchema,
       right: PredicateLeafSchema,
     }),
+    z.object({
+      op: z.literal('lt'),
+      left: PredicateLeafSchema,
+      right: PredicateLeafSchema,
+    }),
     z.object({
       op: z.literal('lte'),
       left: PredicateLeafSchema,
       right: PredicateLeafSchema,
     }),
+    z.object({
+      op: z.literal('gt'),
+      left: PredicateLeafSchema,
+      right: PredicateLeafSchema,
+    }),
+    z.object({
+      op: z.literal('gte'),
+      left: PredicateLeafSchema,
+      right: PredicateLeafSchema,
+    }),
     z.object({
       op: z.literal('in'),
       needle: PredicateLeafSchema,
@@ -348,12 +373,12 @@ const ContextRuleDraftSchema = z
 /** Pinned interpreter address (testnet).
  *  Single source for the MCP layer; do not embed elsewhere. */
 export const PINNED_INTERPRETER_TESTNET_ADDRESS =
-  'CCL336TCK2Y5OFNRCMN2M3HVPBCEX4PW5H6EQ5VW5NPMXOCP4ESB5XR4'
+  'CCBHVZ6HGGV7C4SNHCZ3S5665Z2WEMHTMBAEPO4XW6PKON464BEBANU5'
 
-/** Pinned interpreter address (mainnet), redeployed 2026-08-22 from a reproducible build. The mainnet
+/** Pinned interpreter address (mainnet), redeployed 2026-08-22 for grammar 4, from a reproducible build. The mainnet
  *  interpreter IS the binary exercised on testnet - both instances were created
  *  from the same uploaded wasm hash (see PINNED_INTERPRETER_WASM_SHA256), and
- *  both were read back with `grammar_version()` returning 3. The address differs
+ *  both were read back with `grammar_version()` returning 4. The address differs
  *  because instance ids are network-scoped. UNAUDITED at the time of writing.
  *
  *  These four constants move together or not at all. The grammar version and
@@ -361,15 +386,15 @@ export const PINNED_INTERPRETER_TESTNET_ADDRESS =
  *  alone would have the builder emit a version the other network refuses - with
  *  a green test run, since `grammar-version-parity.test.ts` would then pass. */
 export const PINNED_INTERPRETER_MAINNET_ADDRESS =
-  'CBZXLSTQUITBFZHQH6XRXF3XIVRQR4RHRI64Q5WELS5KGY3ZKJPFWDPF'
+  'CDN755TDYZM3ZQ5OXTJ6TIBUBWZV2KRI2BYJPBXD2MVWED4STT3VBN52'
 
 /** Pinned interpreter wasm sha256 (hex). */
 export const PINNED_INTERPRETER_WASM_SHA256 =
-  'a2b36e8ac5a61caf3757af26aa79e83f2995b451099f44772383806a55fe3414'
+  'b5ba1e35ccf20cd8c13c3a2c3098bf337033a92bcaf475d63c03ddc0cba0fcae'
 
 /** The grammar version the interpreter enforces (matches SELF_VERSION in
  *  contracts/policy-interpreter/src/version.rs). */
-export const PINNED_INTERPRETER_GRAMMAR_VERSION = 3
+export const PINNED_INTERPRETER_GRAMMAR_VERSION = 4
 
 /** Default Soroban RPC for the install / revoke / info tools. The recorder
  *  keeps its own copy in record/rpc.ts because it hands back a fetcher rather
@@ -438,6 +463,18 @@ export const DeclarePolicyInputSchema = z
     recipients: z.array(z.string()).min(1, 'recipients must not be empty').optional(),
     recipientArgIndex: z.number().int().nonnegative().max(U32_MAX).optional(),
     allowZeroCap: z.boolean().optional(),
+    /** Minimum output as a ratio of the call's own input. num/den are decimal
+     *  STRINGS for the same reason maxAmount is: an i128 ratio does not
+     *  survive a JS number. */
+    minOutputRatio: z
+      .object({
+        num: z.string().regex(/^[0-9]+$/, 'num must be an unsigned integer'),
+        den: z.string().regex(/^[0-9]+$/, 'den must be an unsigned integer'),
+        inputArgIndex: z.number().int().nonnegative().max(U32_MAX),
+        outputArgIndex: z.number().int().nonnegative().max(U32_MAX),
+      })
+      .strict()
+      .optional(),
   })
   .strict()
 export type DeclarePolicyInput = z.infer<typeof DeclarePolicyInputSchema>

package/src/simulate/deny-cases.ts

@@ -24,7 +24,7 @@ export interface GeneratedCases {
  *  the wrong reason. */
 const OTHER_CONTRACT = Address.contract(Buffer.alloc(32, 0x5a)).toString()
 
-type ComparisonOperator = 'eq' | 'lte'
+type ComparisonOperator = 'eq' | 'lt' | 'lte' | 'gt' | 'gte'
 
 type ComparisonNode = {
   op: ComparisonOperator
@@ -248,11 +248,22 @@ function visit(node: PredicateNode, facts: PredicateFacts): void {
     case 'and':
       for (const child of node.children) visit(child, facts)
       return
+    // NOT descended into. A deny case works by violating ONE constraint and
+    // asserting the predicate refuses the call. Violating one branch of an
+    // `or` proves nothing, because another branch can still permit, so the
+    // generated case would either fail or pass for the wrong reason. A sound
+    // deny case for a disjunction must violate EVERY branch at once, which
+    // this generator does not construct - so it emits none.
+    case 'or':
+      return
     case 'in':
       facts.memberships.push(node)
       return
     case 'eq':
+    case 'lt':
     case 'lte':
+    case 'gt':
+    case 'gte':
       facts.comparisons.push(node)
   }
 }

package/src/simulate/evaluate.ts

@@ -1,4 +1,4 @@
-// src/simulate/evaluate.ts - TypeScript reference evaluator for grammar version 3.
+// src/simulate/evaluate.ts - TypeScript reference evaluator for grammar version 4.
 //
 // Pure function. Determinism: same `(predicate, ctx)` -> byte-identical result,
 // no clock, no randomness. Deny order (deny on FIRST violation, stable reason):
@@ -8,12 +8,13 @@
 //   3. `in` membership; empty haystack ALWAYS denies         -> 'NOT_IN_ALLOWLIST'
 //   4. otherwise permit.
 //
-// Grammar version 3 nodes: and, eq, lte
-// Grammar version 3 leaves: call_contract, call_fn, call_arg(i),
+// Grammar version 4 nodes: and, or, eq, lt, lte, gt, gte, in
+// Grammar version 4 leaves: call_contract, call_fn, call_arg(i),
 //   call_arg_len(i), call_arg_field(i, element, field),
+//   call_arg_scaled(i, num, den),
 //   literal_address, literal_i128, literal_symbol, literal_u32, literal_vec
-// Grammar version 3 deny reasons: ARG_MISMATCH, CONTRACT_SCOPE,
-//   UNSUPPORTED_NODE, NOT_IN_ALLOWLIST
+// Grammar version 4 deny reasons: ARG_MISMATCH, CONTRACT_SCOPE,
+//   ARITHMETIC_OVERFLOW, UNSUPPORTED_NODE, NOT_IN_ALLOWLIST, SLIPPAGE_FLOOR
 
 import type { PredicateLeaf, PredicateNode, ScVal } from '../types.ts'
 
@@ -28,6 +29,9 @@ export interface EvalContext {
 
 export type EvalResult = { permit: true } | { permit: false; reason: string }
 
+/** The comparison operators grammar 4 carries. */
+type CompareOpName = 'eq' | 'lt' | 'lte' | 'gt' | 'gte'
+
 /** Evaluate a `PredicateNode` against the candidate call described by `ctx`.
  *  Pure function. Returns `{ permit: true }` or `{ permit: false; reason }`. */
 export function evaluate(predicate: PredicateNode, ctx: EvalContext): EvalResult {
@@ -47,8 +51,23 @@ function walk(node: PredicateNode, ctx: EvalContext): EvalResult {
       }
       return lastDeny ?? { permit: true }
     }
+    // Permits on the first branch that holds; when none does, reports the
+    // FIRST branch's reason. Mirrors `Node::Or` in the Rust evaluator, which
+    // the conformance suite pins.
+    case 'or': {
+      let firstDeny: EvalResult | null = null
+      for (const child of node.children) {
+        const r = walk(child, ctx)
+        if (r.permit) return r
+        if (firstDeny === null) firstDeny = r
+      }
+      return firstDeny ?? { permit: false, reason: 'UNSUPPORTED_NODE' }
+    }
     case 'eq':
+    case 'lt':
     case 'lte':
+    case 'gt':
+    case 'gte':
       return evalCompare(node.op, node.left, node.right, ctx)
     case 'in':
       return evalIn(node.needle, node.haystack, ctx)
@@ -57,11 +76,22 @@ function walk(node: PredicateNode, ctx: EvalContext): EvalResult {
 
 /** Comparison leaf evaluation. */
 function evalCompare(
-  op: 'eq' | 'lte',
+  op: CompareOpName,
   left: PredicateLeaf,
   right: PredicateLeaf,
   ctx: EvalContext
 ): EvalResult {
+  // Scaled operands first, so the dedicated reasons reach the caller instead
+  // of a generic mismatch. Right-hand dispatch leads because
+  // `out >= in * num / den` is the canonical swap form. Mirrors the order in
+  // `eval_compare` on the Rust side.
+  if (right.kind === 'call_arg_scaled') {
+    return evalScaledCompare(op, left, right, true, ctx)
+  }
+  if (left.kind === 'call_arg_scaled') {
+    return evalScaledCompare(op, right, left, false, ctx)
+  }
+
   // CONTRACT_SCOPE on call_contract eq
   if (left.kind === 'call_contract' && op === 'eq') {
     if (right.kind !== 'literal_address') return { permit: false, reason: 'CONTRACT_SCOPE' }
@@ -112,10 +142,66 @@ function evalCompare(
   return { permit: false, reason: 'UNSUPPORTED_NODE' }
 }
 
+/** i128 bounds. The contract computes in i128 and denies on overflow, so the
+ *  reference has to draw the same line or the two layers disagree on inputs
+ *  near the boundary. */
+const I128_MIN = -(2n ** 127n)
+const I128_MAX = 2n ** 127n - 1n
+
+/** Comparison where one side is `call_arg_scaled`. Mirrors
+ *  `eval_scaled_arg_compare`: `args[index] * num / den` truncating toward
+ *  zero, ARITHMETIC_OVERFLOW on arithmetic that does not fit or a zero
+ *  denominator, SLIPPAGE_FLOOR on a comparison that simply fails. */
+function evalScaledCompare(
+  op: CompareOpName,
+  other: PredicateLeaf,
+  scaled: Extract<PredicateLeaf, { kind: 'call_arg_scaled' }>,
+  scaledOnRight: boolean,
+  ctx: EvalContext
+): EvalResult {
+  // Chaining two computed operands has no meaning a review card could state.
+  if (other.kind === 'call_arg_scaled') return { permit: false, reason: 'UNSUPPORTED_NODE' }
+
+  // Could not READ the operand is a different failure from read-and-missed.
+  const input = argNumericBigInt(ctx.args[scaled.index])
+  if (input === null) return { permit: false, reason: 'ARG_MISMATCH' }
+
+  let num: bigint
+  let den: bigint
+  try {
+    num = BigInt(scaled.num)
+    den = BigInt(scaled.den)
+  } catch {
+    return { permit: false, reason: 'ARG_MISMATCH' }
+  }
+  if (den === 0n) return { permit: false, reason: 'ARITHMETIC_OVERFLOW' }
+
+  const product = input * num
+  if (product < I128_MIN || product > I128_MAX) {
+    return { permit: false, reason: 'ARITHMETIC_OVERFLOW' }
+  }
+  // BigInt division already truncates toward zero, matching i128 semantics.
+  const quotient = product / den
+  if (quotient < I128_MIN || quotient > I128_MAX) {
+    return { permit: false, reason: 'ARITHMETIC_OVERFLOW' }
+  }
+
+  const otherVal =
+    other.kind === 'call_arg'
+      ? argNumericBigInt(ctx.args[other.index])
+      : literalNumericBigInt(other)
+  if (otherVal === null) return { permit: false, reason: 'ARG_MISMATCH' }
+
+  const [a, b] = scaledOnRight ? [otherVal, quotient] : [quotient, otherVal]
+  return bigintCmp(op, a.toString(), b.toString())
+    ? { permit: true }
+    : { permit: false, reason: 'SLIPPAGE_FLOOR' }
+}
+
 /** Per-ScVal equality. Handles literal_vec as an EXACT ordered sequence:
  *  compare element-by-element in order; deny if length or any element differs.
  *  Opaque args (`type: 'other'`) fail closed. */
-function evalArgEq(op: 'eq' | 'lte', actual: ScVal | undefined, right: PredicateLeaf): EvalResult {
+function evalArgEq(op: CompareOpName, actual: ScVal | undefined, right: PredicateLeaf): EvalResult {
   // eq(call_arg[i], literal_vec) -> EXACT ordered vector equality.
   if (op === 'eq' && right.kind === 'literal_vec') {
     if (actual?.type !== 'vec') return { permit: false, reason: 'ARG_MISMATCH' }
@@ -163,7 +249,7 @@ function evalArgEq(op: 'eq' | 'lte', actual: ScVal | undefined, right: Predicate
  *  to a numeric literal via BigInt. A non-numeric arg or a non-numeric literal
  *  fails closed (ARG_MISMATCH) rather than permitting an undecidable bound. */
 function evalArgOrderedCompare(
-  op: 'eq' | 'lte',
+  op: CompareOpName,
   actual: ScVal | undefined,
   right: PredicateLeaf
 ): EvalResult {
@@ -272,13 +358,19 @@ function resolveLeaf(leaf: PredicateLeaf, ctx: EvalContext): ScVal | undefined {
 }
 
 /** BigInt compare helper. */
-function bigintCmp(op: 'eq' | 'lte', aStr: string, bStr: string): boolean {
+function bigintCmp(op: CompareOpName, aStr: string, bStr: string): boolean {
   const a = BigInt(aStr)
   const b = BigInt(bStr)
   switch (op) {
     case 'eq':
       return a === b
+    case 'lt':
+      return a < b
     case 'lte':
       return a <= b
+    case 'gt':
+      return a > b
+    case 'gte':
+      return a >= b
   }
 }

package/src/synth/declare.ts

@@ -15,11 +15,12 @@
 // first: it constrains the amount in THIS call rather than implying a rolling
 // total nothing tracks.
 //
-// What a declaration can say maps one-to-one onto grammar 3:
-//   fn         -> eq(call_fn, literal_symbol)
-//   contract   -> eq(call_contract, literal_address)
-//   maxAmount  -> lte(call_arg(i), literal_i128)
-//   recipients -> in(call_arg(j), [literal_address, ...])
+// What a declaration can say maps one-to-one onto grammar 4:
+//   fn            -> eq(call_fn, literal_symbol)
+//   contract      -> eq(call_contract, literal_address)
+//   maxAmount     -> lte(call_arg(i), literal_i128)
+//   recipients    -> in(call_arg(j), [literal_address, ...])
+//   minOutputRatio-> gte(call_arg(out), call_arg_scaled(in, num, den))
 
 import type { ToolError } from '../errors.ts'
 import type { PredicateLeaf, PredicateNode } from '../types.ts'
@@ -52,6 +53,14 @@ export interface PolicyDeclaration {
    *  explicitly. A rule that permits nothing is a plausible thing to want and
    *  an implausible thing to want by accident. */
   allowZeroCap?: boolean
+  /** Minimum output as a ratio of the call's own input: the output argument
+   *  must be at least `input * num / den`.
+   *
+   *  A swap's acceptable output depends on the size of the trade, so a fixed
+   *  floor would pin the policy to one trade size. The ratio is DECLARED, never
+   *  inferred from a recording: a recorded rate is a price at one moment, and
+   *  freezing it as policy would deny ordinary trades later. */
+  minOutputRatio?: { num: string; den: string; inputArgIndex: number; outputArgIndex: number }
 }
 
 export interface DeclaredPredicate {
@@ -137,6 +146,46 @@ export function declarePredicate(d: PolicyDeclaration): DeclaredPredicate {
     })
   }
 
+  if (d.minOutputRatio !== undefined) {
+    const { num, den, inputArgIndex, outputArgIndex } = d.minOutputRatio
+    if (!/^[0-9]+$/.test(num) || !/^[0-9]+$/.test(den)) {
+      throw declareError(
+        'SYNTHESIS_ERROR',
+        `minOutputRatio num/den must be unsigned integers, got "${num}"/"${den}" (a 1% slippage tolerance is num "99", den "100")`
+      )
+    }
+    // Both are refused on chain at install (INVALID_SCALED_RATIO). Refusing
+    // here too means the caller learns before a transaction is built.
+    if (den === '0') {
+      throw declareError('SYNTHESIS_ERROR', 'minOutputRatio.den is zero: the ratio has no value')
+    }
+    if (num === '0') {
+      throw declareError(
+        'SYNTHESIS_ERROR',
+        'minOutputRatio.num is zero: the floor would be zero, which constrains nothing. Omit it instead.'
+      )
+    }
+    if (inputArgIndex === outputArgIndex) {
+      throw declareError(
+        'SYNTHESIS_ERROR',
+        `minOutputRatio bounds arg[${inputArgIndex}] against itself, which is true for any ratio at or below 1 and false above it - never a slippage floor. Pass the distinct input and output positions.`
+      )
+    }
+    if (BigInt(num) > BigInt(den)) {
+      // Demanding MORE out than went in is not slippage protection; it is a
+      // rule that denies every honest trade. Loud beats a policy that never
+      // permits.
+      warnings.push(
+        `minOutputRatio ${num}/${den} is above 1: it requires the output to EXCEED the input, which no ordinary swap satisfies. Check the ratio is not inverted.`
+      )
+    }
+    children.push({
+      op: 'gte',
+      left: { kind: 'call_arg', index: outputArgIndex },
+      right: { kind: 'call_arg_scaled', index: inputArgIndex, num, den },
+    })
+  }
+
   // A single conjunct is emitted bare. `and` with one child encodes to
   // different bytes than the child alone, and the extra node buys nothing.
   const predicate: PredicateNode =

package/src/synth/synthesize-from-recording.ts

@@ -1,7 +1,7 @@
 // src/synth/synthesize-from-recording.ts - recording-path orchestrator.
 //
 // `synthesizeFromRecording` INFERS a bounded policy from a `RecordedTransaction`
-// via the `PolicyIR` + interpreter adapter pair.
+// via the composer + interpreter adapter pair.
 // Flow: validate -> parseConfidence gate -> lower -> decideScope -> composeFromRecording
 // -> interpreter compile + self-verify.
 // Same (tx, opts) -> byte-identical ProposedPolicy (no randomness, clock, globals).