@mikeargento/bitgraph-player 0.1.0

package/src/__tests__/evaluate-verdict.test.ts

@@ -0,0 +1,266 @@
+// Copyright (c) 2024-2026 Mike Argento. Licensed under the MIT License. See LICENSE.
+
+import { strict as assert } from "node:assert";
+import { test } from "node:test";
+import { resolveCast } from "../cast.js";
+import { evaluate } from "../evaluate.js";
+import { parseRule } from "../rule.js";
+import { buildVerdict, serializeVerdict } from "../verdict.js";
+import { digestFor, makeAudit } from "./fixtures.js";
+import type { Rule } from "../types.js";
+
+const PO = digestFor("purchase-order");
+const DEL = digestFor("delivery");
+const APPR = digestFor("approval");
+const CANCEL = digestFor("cancellation");
+
+/**
+ * The flagship shape: po -> delivery -> approval in one chain-linked
+ * component; a cancellation digest that was never recorded, declared
+ * optional.
+ */
+function poAudit() {
+  return makeAudit({
+    proofs: [
+      { name: "po", digestB64: PO, epochId: "E1", counter: "10", slotCounter: "9" },
+      { name: "del", digestB64: DEL, epochId: "E1", counter: "20", slotCounter: "19", prev: "po" },
+      { name: "appr", digestB64: APPR, epochId: "E1", counter: "30", slotCounter: "29", prev: "del" },
+    ],
+    partitions: [
+      { epochId: "E1", members: ["po", "del", "appr"], components: [["po", "del", "appr"]] },
+    ],
+  });
+}
+
+function poRule(overrides?: { ordering?: string; cancellationDigest?: string }): Rule {
+  return parseRule(
+    JSON.stringify({
+      rule: "bitgraph-player/1",
+      id: "po-release-payment",
+      cast: {
+        purchase_order: { digest: PO, means: "PO-4471" },
+        delivery: { digest: DEL },
+        approval: { digest: APPR, signedBy: { kind: "c2pa", manifest: "m-123" } },
+        cancellation: { digest: overrides?.cancellationDigest ?? CANCEL, optional: true },
+      },
+      world: "closed",
+      requires: { ordering: overrides?.ordering ?? "hash-linked" },
+      claim: {
+        all: [
+          { exists: "purchase_order" },
+          { after: ["delivery", "purchase_order"] },
+          { after: ["approval", "delivery"] },
+          { not: { before: ["cancellation", "approval"] } },
+        ],
+      },
+      then: { label: "release_payment" },
+    })
+  );
+}
+
+test("the purchase-order rule holds over a chain-linked fixture", () => {
+  const audit = poAudit();
+  const rule = poRule();
+  const evaluation = evaluate(rule, resolveCast(rule.cast, audit), audit);
+  assert.equal(evaluation.result, "TRUE");
+  assert.equal(evaluation.weakestEvidence, "hash-linked");
+  // Full walk: every sub-claim recorded.
+  assert.equal(evaluation.steps.length, 4);
+});
+
+test("absent-optional supports the negative: no cancellation precedes approval", () => {
+  const audit = poAudit();
+  const rule = poRule();
+  const evaluation = evaluate(rule, resolveCast(rule.cast, audit), audit);
+  const negStep = evaluation.steps.find((s) => s.claim.startsWith("before(cancellation"));
+  assert.ok(negStep);
+  assert.equal(negStep.result, "FALSE"); // so not(...) is TRUE
+});
+
+test("PLAN test: counter-order evidence under a hash-linked floor is UNDETERMINED, not TRUE and not FALSE", () => {
+  const audit = makeAudit({
+    proofs: [
+      { name: "po", digestB64: PO, epochId: "E1", counter: "10" },
+      { name: "del", digestB64: DEL, epochId: "E1", counter: "20" },
+    ],
+    // Separate components: counter-order only.
+    partitions: [{ epochId: "E1", members: ["po", "del"], components: [["po"], ["del"]] }],
+  });
+  const rule = parseRule(
+    JSON.stringify({
+      rule: "bitgraph-player/1",
+      id: "floor-test",
+      cast: { po: { digest: PO }, del: { digest: DEL } },
+      world: "closed",
+      requires: { ordering: "hash-linked" },
+      claim: { before: ["po", "del"] },
+    })
+  );
+  const evaluation = evaluate(rule, resolveCast(rule.cast, audit), audit);
+  assert.equal(evaluation.result, "UNDETERMINED");
+  // And the same evidence under the permissive floor answers TRUE.
+  const permissive = parseRule(
+    JSON.stringify({
+      rule: "bitgraph-player/1",
+      id: "floor-test-2",
+      cast: { po: { digest: PO }, del: { digest: DEL } },
+      world: "closed",
+      requires: { ordering: "assumption-dependent" },
+      claim: { before: ["po", "del"] },
+    })
+  );
+  const evaluation2 = evaluate(permissive, resolveCast(permissive.cast, audit), audit);
+  assert.equal(evaluation2.result, "TRUE");
+  assert.equal(evaluation2.weakestEvidence, "assumption-dependent");
+});
+
+test("the floor gates FALSE outcomes too: distrusted evidence is silent in both directions", () => {
+  const audit = makeAudit({
+    proofs: [
+      { name: "po", digestB64: PO, epochId: "E1", counter: "10" },
+      { name: "del", digestB64: DEL, epochId: "E1", counter: "20" },
+    ],
+    partitions: [{ epochId: "E1", members: ["po", "del"], components: [["po"], ["del"]] }],
+  });
+  const rule = parseRule(
+    JSON.stringify({
+      rule: "bitgraph-player/1",
+      id: "floor-false",
+      cast: { po: { digest: PO }, del: { digest: DEL } },
+      world: "closed",
+      requires: { ordering: "hash-linked" },
+      claim: { before: ["del", "po"] }, // would be FALSE on counter-order evidence
+    })
+  );
+  const evaluation = evaluate(rule, resolveCast(rule.cast, audit), audit);
+  assert.equal(evaluation.result, "UNDETERMINED");
+});
+
+test("PLAN test: a negative predicate naming an undeclared role is UNDETERMINED, not FALSE", () => {
+  const audit = poAudit();
+  const rule = parseRule(
+    JSON.stringify({
+      rule: "bitgraph-player/1",
+      id: "open-world-negative",
+      cast: { approval: { digest: APPR } },
+      world: "closed",
+      requires: { ordering: "hash-linked" },
+      claim: { not: { before: ["ghost", "approval"] } },
+    })
+  );
+  const evaluation = evaluate(rule, resolveCast(rule.cast, audit), audit);
+  assert.equal(evaluation.result, "UNDETERMINED");
+});
+
+test("PLAN test: two recordings of the same bits and no pin is UNDETERMINED", () => {
+  const audit = makeAudit({
+    proofs: [
+      { name: "x1", digestB64: PO, epochId: "E1", counter: "100" },
+      { name: "other", digestB64: DEL, epochId: "E1", counter: "200", prev: "x1" },
+      { name: "x2", digestB64: PO, epochId: "E1", counter: "300", prev: "other" },
+    ],
+    partitions: [
+      { epochId: "E1", members: ["x1", "x2", "other"], components: [["x1", "x2", "other"]] },
+    ],
+  });
+  const rule = parseRule(
+    JSON.stringify({
+      rule: "bitgraph-player/1",
+      id: "multiplicity",
+      cast: { x: { digest: PO }, other: { digest: DEL } },
+      world: "closed",
+      requires: { ordering: "hash-linked" },
+      claim: { after: ["x", "other"] }, // TRUE and FALSE at once without an occurrence pin
+    })
+  );
+  const evaluation = evaluate(rule, resolveCast(rule.cast, audit), audit);
+  assert.equal(evaluation.result, "UNDETERMINED");
+
+  // A pin resolves the ambiguity and the claim becomes decidable.
+  const pinned = parseRule(
+    JSON.stringify({
+      rule: "bitgraph-player/1",
+      id: "multiplicity-pinned",
+      cast: {
+        x: { digest: PO, at: { epochId: "E1", counter: "300" } },
+        other: { digest: DEL },
+      },
+      world: "closed",
+      requires: { ordering: "hash-linked" },
+      claim: { after: ["x", "other"] },
+    })
+  );
+  const evaluation2 = evaluate(pinned, resolveCast(pinned.cast, audit), audit);
+  assert.equal(evaluation2.result, "TRUE");
+});
+
+test("required-absent is UNDETERMINED; between works over a chain", () => {
+  const audit = poAudit();
+  const missingRequired = parseRule(
+    JSON.stringify({
+      rule: "bitgraph-player/1",
+      id: "missing-required",
+      cast: { ghost: { digest: digestFor("never-recorded") } },
+      world: "closed",
+      requires: { ordering: "hash-linked" },
+      claim: { exists: "ghost" },
+    })
+  );
+  assert.equal(
+    evaluate(missingRequired, resolveCast(missingRequired.cast, audit), audit).result,
+    "UNDETERMINED"
+  );
+
+  const between = parseRule(
+    JSON.stringify({
+      rule: "bitgraph-player/1",
+      id: "between",
+      cast: { po: { digest: PO }, del: { digest: DEL }, appr: { digest: APPR } },
+      world: "closed",
+      requires: { ordering: "hash-linked" },
+      claim: { between: ["del", "po", "appr"] },
+    })
+  );
+  const evaluation = evaluate(between, resolveCast(between.cast, audit), audit);
+  assert.equal(evaluation.result, "TRUE");
+  assert.equal(evaluation.steps.length, 2); // between records both halves
+});
+
+// ---------------------------------------------------------------------------
+// Verdict shape and determinism.
+// ---------------------------------------------------------------------------
+
+test("verdict carries the trust boundary: declared holds means, signedBy, and the closed world", () => {
+  const audit = poAudit();
+  const rule = poRule();
+  const resolutions = resolveCast(rule.cast, audit);
+  const evaluation = evaluate(rule, resolutions, audit);
+  const verdict = buildVerdict(rule, "ab".repeat(32), resolutions, evaluation, audit);
+
+  const assertions = verdict.declared.map((d) => d.assertion);
+  assert.ok(assertions.includes("means"));
+  assert.ok(assertions.includes("signedBy"));
+  assert.equal(assertions[assertions.length - 1], "closed-world");
+
+  const closedWorld = verdict.declared[verdict.declared.length - 1] as Record<string, unknown>;
+  assert.equal(closedWorld["castSize"], 4);
+  assert.equal(closedWorld["recordingsInBundle"], 3);
+  for (const d of verdict.declared) assert.equal(d.verifiedHere, false);
+  assert.equal(verdict.network, "none");
+});
+
+test("verdict bytes are deterministic and carry no timestamp", () => {
+  const audit = poAudit();
+  const rule = poRule();
+  const run = () => {
+    const resolutions = resolveCast(rule.cast, audit);
+    const evaluation = evaluate(rule, resolutions, audit);
+    return serializeVerdict(buildVerdict(rule, "ab".repeat(32), resolutions, evaluation, audit));
+  };
+  const first = run();
+  const second = run();
+  assert.equal(first, second);
+  assert.ok(!/generatedAt|startedAt|timestamp":/.test(first), "no run timestamp in verdict bytes");
+  assert.ok(!first.includes("fixture-path"), "no machine paths in verdict bytes");
+  assert.ok(first.endsWith("\n"));
+});

package/src/__tests__/fixtures.ts

@@ -0,0 +1,206 @@
+// Copyright (c) 2024-2026 Mike Argento. Licensed under the MIT License. See LICENSE.
+
+/**
+ * Synthetic AuditResult fixtures for unit tests.
+ *
+ * Deliberately NOT real proofs and NOT run through the verifier: Player is
+ * a pure function over runAudit's OUTPUT, so unit tests exercise it against
+ * hand-built AuditResult shapes. No test ever writes to the ledger — the
+ * ledger is compliance-locked and recordings are permanent — and the
+ * integration/acceptance path uses existing exports read-only instead.
+ */
+
+import type { AuditResult, ObservedProof, SegmentBound } from "@mikeargento/bitgraph-audit";
+
+export interface FixtureProofSpec {
+  /** Short name; expands deterministically into hashes. */
+  name: string;
+  digestB64: string;
+  epochId?: string;
+  chainId?: string;
+  publicKeyB64?: string;
+  counter?: string;
+  slotCounter?: string;
+  /** Name of the predecessor proof this one links to via prevB64. */
+  prev?: string;
+  verified?: boolean;
+  tier?: "full" | "integrity";
+  status?: "verified" | "failed" | "artifact-unavailable";
+}
+
+export function proofHashOf(name: string): string {
+  return `proofhash-${name}`;
+}
+
+export function makeProof(spec: FixtureProofSpec): ObservedProof {
+  const tier = spec.tier ?? "full";
+  const status =
+    spec.status ??
+    (spec.verified === false
+      ? "failed"
+      : tier === "integrity"
+        ? "artifact-unavailable"
+        : "verified");
+  const proof = {
+    proofHash: proofHashOf(spec.name),
+    chainHash: `chainhash-${spec.name}`,
+    proof: {
+      version: "bitgraph/1",
+      artifact: { hashAlg: "sha256", digestB64: spec.digestB64 },
+    },
+    sources: [],
+    version: "bitgraph/1",
+    chainId: spec.chainId ?? "bitgraph:main",
+    publicKeyB64: spec.publicKeyB64 ?? "key-A",
+    hasSlotAllocation: true,
+    hasAttestation: false,
+    hasAgency: false,
+    hasEpochLink: false,
+    embeddedProofHash: "absent",
+    chainless: spec.counter === undefined && spec.epochId === undefined,
+    verification: { tier, status },
+  } as Record<string, unknown>;
+  if (spec.epochId !== undefined) proof["epochId"] = spec.epochId;
+  if (spec.counter !== undefined) proof["counter"] = spec.counter;
+  if (spec.slotCounter !== undefined) proof["slotCounter"] = spec.slotCounter;
+  if (spec.prev !== undefined) proof["prevB64"] = `chainhash-${spec.prev}`;
+  return proof as unknown as ObservedProof;
+}
+
+export interface FixturePartitionSpec {
+  publicKeyB64?: string;
+  epochId?: string;
+  chainId?: string;
+  /** Member proof NAMES (expanded via proofHashOf). */
+  members: string[];
+  /** Component groupings by proof name; defaults to one component per member. */
+  components?: string[][];
+}
+
+export interface FixtureSegmentSpec {
+  /** Member proof names. */
+  members: string[];
+  lowerBounds?: Partial<SegmentBound>[];
+  upperBounds?: Partial<SegmentBound>[];
+}
+
+export function makeBound(partial: Partial<SegmentBound>): SegmentBound {
+  return {
+    kind: partial.kind ?? "not-before",
+    anchorProofHash: partial.anchorProofHash ?? "anchor-x",
+    blockHash: partial.blockHash ?? "0x" + "0".repeat(64),
+    timestamp: partial.timestamp ?? 0,
+    evidence: partial.evidence ?? "chain-link",
+    weaker: partial.weaker ?? false,
+    basis: partial.basis ?? "block-hash-unpredictability",
+    claim: partial.claim ?? "fixture bound",
+    ...(partial.blockNumber !== undefined ? { blockNumber: partial.blockNumber } : {}),
+  };
+}
+
+export interface FixtureAuditSpec {
+  proofs: FixtureProofSpec[];
+  partitions?: FixturePartitionSpec[];
+  /** Epoch lineage pairs, transitive, as audit reports them. */
+  orderedPairs?: { beforeEpochId: string; afterEpochId: string }[];
+  /** Hard epochLink edges by proof NAME: predecessor and via. */
+  edges?: { predecessor: string; via: string }[];
+  segments?: FixtureSegmentSpec[];
+  unchained?: string[];
+}
+
+export function makeAudit(spec: FixtureAuditSpec): AuditResult {
+  const proofs = spec.proofs.map(makeProof);
+  const partitions = (spec.partitions ?? []).map((p) => {
+    const members = p.members.map(proofHashOf);
+    const components = (p.components ?? p.members.map((m) => [m])).map((group) => ({
+      memberProofHashes: group.map(proofHashOf),
+    }));
+    const key: Record<string, unknown> = {
+      publicKeyB64: p.publicKeyB64 ?? "key-A",
+      chainId: p.chainId ?? "bitgraph:main",
+    };
+    if (p.epochId !== undefined) key["epochId"] = p.epochId;
+    return { key, memberProofHashes: members, components };
+  });
+  const segments = (spec.segments ?? []).map((s) => ({
+    partition: { publicKeyB64: "key-A", chainId: "bitgraph:main" },
+    memberProofHashes: s.members.map(proofHashOf),
+    status: "bracketed",
+    lowerBounds: (s.lowerBounds ?? []).map((b) => makeBound({ ...b, kind: "not-before" })),
+    upperBounds: (s.upperBounds ?? []).map((b) => makeBound({ ...b, kind: "not-after" })),
+  }));
+  const audit = {
+    runMetadata: {
+      toolVersion: "fixture",
+      startedAt: "1970-01-01T00:00:00.000Z",
+      bundlePath: "fixture",
+      container: "directory",
+    },
+    ingest: {
+      bundlePath: "fixture",
+      container: "directory",
+      entriesScanned: proofs.length,
+      proofs,
+      unsupportedVersions: [],
+      artifacts: [],
+      witnesses: [],
+      computedContentsHashB64: "fixture",
+      findings: [],
+      counts: {
+        observed: proofs.length,
+        proofFiles: proofs.length,
+        exactDuplicates: 0,
+        semanticDuplicates: 0,
+        unsupportedVersion: 0,
+        artifacts: 0,
+        witnesses: 0,
+        skippedUnsafePaths: 0,
+      },
+    },
+    verification: {},
+    reconstruction: {
+      partitions,
+      unchainedProofHashes: (spec.unchained ?? []).map(proofHashOf),
+      unpartitionedProofHashes: [],
+      epochRelationships: {
+        epochs: [],
+        edges: (spec.edges ?? []).map((e) => {
+          const pred = spec.proofs.find((p) => p.name === e.predecessor);
+          const via = spec.proofs.find((p) => p.name === e.via);
+          return {
+            fromEpochId: pred?.epochId ?? "?",
+            toEpochId: via?.epochId ?? "?",
+            viaProofHash: proofHashOf(e.via),
+            link: {},
+            resolution: "matched",
+            predecessorProofHash: proofHashOf(e.predecessor),
+            metadataConsistent: true,
+            viaProofValid: true,
+            predecessorValid: true,
+            hardEdge: true,
+          };
+        }),
+        orderedPairs: spec.orderedPairs ?? [],
+      },
+    },
+    anomalies: {},
+    authorities: {},
+    anchors: {},
+    witnesses: {},
+    temporal: {
+      segments,
+      anchorOrderedPairs: [],
+      verifiedAnchorProofHashes: [],
+      unverifiedAnchorProofHashes: [],
+    },
+    attestations: {},
+  };
+  return audit as unknown as AuditResult;
+}
+
+/** A digest spelled the way rules spell it, unique per tag. */
+export function digestFor(tag: string): string {
+  // 32 bytes: the tag padded; deterministic and valid base64 once encoded.
+  return Buffer.from(tag.padEnd(32, ".")).toString("base64");
+}

package/src/__tests__/logic-rule.test.ts

@@ -0,0 +1,221 @@
+// Copyright (c) 2024-2026 Mike Argento. Licensed under the MIT License. See LICENSE.
+
+import { strict as assert } from "node:assert";
+import { test } from "node:test";
+import { kleeneAll, kleeneAny, kleeneNot } from "../logic.js";
+import { normalizeDigest, parseRule, RuleError } from "../rule.js";
+import type { ThreeValued } from "../types.js";
+
+const T: ThreeValued = "TRUE";
+const F: ThreeValued = "FALSE";
+const U: ThreeValued = "UNDETERMINED";
+const VALUES: readonly ThreeValued[] = [T, F, U];
+
+// ---------------------------------------------------------------------------
+// Kleene tables, exhaustively for the binary projections.
+// ---------------------------------------------------------------------------
+
+test("kleeneNot table", () => {
+  assert.equal(kleeneNot(T), F);
+  assert.equal(kleeneNot(F), T);
+  assert.equal(kleeneNot(U), U);
+});
+
+test("kleeneAll pairwise table", () => {
+  const expect: Record<string, ThreeValued> = {
+    "TRUE,TRUE": T,
+    "TRUE,FALSE": F,
+    "TRUE,UNDETERMINED": U,
+    "FALSE,TRUE": F,
+    "FALSE,FALSE": F,
+    "FALSE,UNDETERMINED": F,
+    "UNDETERMINED,TRUE": U,
+    "UNDETERMINED,FALSE": F,
+    "UNDETERMINED,UNDETERMINED": U,
+  };
+  for (const a of VALUES) {
+    for (const b of VALUES) {
+      assert.equal(kleeneAll([a, b]), expect[`${a},${b}`], `all([${a}, ${b}])`);
+    }
+  }
+  assert.equal(kleeneAll([]), T, "empty conjunction is vacuously TRUE");
+});
+
+test("kleeneAny pairwise table", () => {
+  const expect: Record<string, ThreeValued> = {
+    "TRUE,TRUE": T,
+    "TRUE,FALSE": T,
+    "TRUE,UNDETERMINED": T,
+    "FALSE,TRUE": T,
+    "FALSE,FALSE": F,
+    "FALSE,UNDETERMINED": U,
+    "UNDETERMINED,TRUE": T,
+    "UNDETERMINED,FALSE": U,
+    "UNDETERMINED,UNDETERMINED": U,
+  };
+  for (const a of VALUES) {
+    for (const b of VALUES) {
+      assert.equal(kleeneAny([a, b]), expect[`${a},${b}`], `any([${a}, ${b}])`);
+    }
+  }
+  assert.equal(kleeneAny([]), F, "empty disjunction is vacuously FALSE");
+});
+
+test("UNDETERMINED never launders into FALSE through not", () => {
+  // The single easiest way to make Player dishonest is a boolean evaluator.
+  assert.notEqual(kleeneNot(U), T);
+  assert.notEqual(kleeneNot(U), F);
+});
+
+// ---------------------------------------------------------------------------
+// Digest normalization: four spellings, one canonical form.
+// ---------------------------------------------------------------------------
+
+test("normalizeDigest accepts hex, sha256:hex, base64, base64url identically", () => {
+  const bytes = Buffer.alloc(32, 7);
+  const hex = bytes.toString("hex");
+  const b64 = bytes.toString("base64");
+  const b64url = bytes.toString("base64url");
+  assert.equal(normalizeDigest(hex), b64);
+  assert.equal(normalizeDigest(`sha256:${hex}`), b64);
+  assert.equal(normalizeDigest(b64), b64);
+  assert.equal(normalizeDigest(b64url), b64);
+});
+
+test("normalizeDigest rejects malformed input", () => {
+  assert.equal(normalizeDigest("not-a-digest"), undefined);
+  assert.equal(normalizeDigest("sha256:abcd"), undefined);
+  assert.equal(normalizeDigest(""), undefined);
+});
+
+// ---------------------------------------------------------------------------
+// Rule parsing.
+// ---------------------------------------------------------------------------
+
+const DIGEST = Buffer.alloc(32, 1).toString("base64");
+
+function baseRule(): Record<string, unknown> {
+  return {
+    rule: "bitgraph-player/1",
+    id: "test-rule",
+    cast: { a: { digest: DIGEST } },
+    world: "closed",
+    requires: { ordering: "hash-linked" },
+    claim: { exists: "a" },
+  };
+}
+
+test("a well-formed rule parses", () => {
+  const rule = parseRule(JSON.stringify(baseRule()));
+  assert.equal(rule.id, "test-rule");
+  assert.equal(rule.requires.ordering, "hash-linked");
+});
+
+test("a rule with no requires.ordering does not parse (mandatory trust floor)", () => {
+  const raw = baseRule();
+  delete raw["requires"];
+  assert.throws(() => parseRule(JSON.stringify(raw)), RuleError);
+
+  const raw2 = baseRule();
+  raw2["requires"] = {};
+  assert.throws(() => parseRule(JSON.stringify(raw2)), RuleError);
+});
+
+test("world is mandatory and must be closed", () => {
+  const raw = baseRule();
+  delete raw["world"];
+  assert.throws(() => parseRule(JSON.stringify(raw)), RuleError);
+  raw["world"] = "open";
+  assert.throws(() => parseRule(JSON.stringify(raw)), RuleError);
+});
+
+test("unknown fields are rejected at every level", () => {
+  const top = baseRule();
+  top["webhook"] = "https://example.com";
+  assert.throws(() => parseRule(JSON.stringify(top)), RuleError);
+
+  const castLevel = baseRule();
+  (castLevel["cast"] as Record<string, unknown>)["a"] = { digest: DIGEST, url: "x" };
+  assert.throws(() => parseRule(JSON.stringify(castLevel)), RuleError);
+});
+
+test("then accepts a label and nothing capable of causing an action", () => {
+  const ok = baseRule();
+  ok["then"] = { label: "release_payment" };
+  assert.equal(parseRule(JSON.stringify(ok)).then?.label, "release_payment");
+
+  // Constraint 3 enforced by the format: the first request for a webhook
+  // field is a request to make Player an enforcer.
+  const bad = baseRule();
+  bad["then"] = { label: "x", webhook: "https://example.com/pay" };
+  assert.throws(() => parseRule(JSON.stringify(bad)), RuleError);
+});
+
+test("claims must have exactly one known operator", () => {
+  const bad = baseRule();
+  bad["claim"] = { exists: "a", before: ["a", "a"] };
+  assert.throws(() => parseRule(JSON.stringify(bad)), RuleError);
+
+  const unknown = baseRule();
+  unknown["claim"] = { precedes: ["a", "b"] };
+  assert.throws(() => parseRule(JSON.stringify(unknown)), RuleError);
+});
+
+test("a claim referencing an undeclared role still parses (evaluates to UNDETERMINED, not a parse error)", () => {
+  const raw = baseRule();
+  raw["claim"] = { not: { before: ["ghost", "a"] } };
+  const rule = parseRule(JSON.stringify(raw));
+  assert.ok(rule);
+});
+
+test("malformed digests are parse errors", () => {
+  const raw = baseRule();
+  (raw["cast"] as Record<string, unknown>)["a"] = { digest: "zzzz" };
+  assert.throws(() => parseRule(JSON.stringify(raw)), RuleError);
+});
+
+test("a role named __proto__ is an ordinary own key, never a prototype assignment", () => {
+  // Built as JSON text: a JS object literal cannot even express an own
+  // "__proto__" key by assignment, which is exactly the trap the parser
+  // must not fall into on its side.
+  const json =
+    `{"rule":"bitgraph-player/1","id":"t",` +
+    `"cast":{"a":{"digest":"${DIGEST}"},"__proto__":{"digest":"${DIGEST}"}},` +
+    `"world":"closed","requires":{"ordering":"hash-linked"},"claim":{"exists":"__proto__"}}`;
+  const rule = parseRule(json);
+  assert.ok(Object.keys(rule.cast).includes("__proto__"), "role survives as an own key");
+  assert.ok(Object.keys(rule.cast).includes("a"));
+  assert.equal(Object.getPrototypeOf(rule.cast), null);
+});
+
+test("pure-integer role names are rejected (declaration order would not survive)", () => {
+  const raw = baseRule();
+  (raw["cast"] as Record<string, unknown>)["2"] = { digest: DIGEST };
+  assert.throws(() => parseRule(JSON.stringify(raw)), RuleError);
+});
+
+test("non-canonical base64 spellings are rejected, not silently reinterpreted", () => {
+  // 43 chars + pad decodes to 32 bytes but carries nonzero trailing
+  // padding bits: Node's lenient decoder drops them, so accepting the
+  // spelling would collapse it into different bytes than written.
+  const nonCanonical = "A".repeat(42) + "B=";
+  assert.equal(normalizeDigest(nonCanonical), undefined);
+  const canonical = Buffer.alloc(32, 7).toString("base64");
+  assert.equal(normalizeDigest(canonical), canonical);
+});
+
+test("at pin must be exactly one of the two forms", () => {
+  const both = baseRule();
+  (both["cast"] as Record<string, unknown>)["a"] = {
+    digest: DIGEST,
+    at: { proofHash: "p", epochId: "e", counter: "1" },
+  };
+  assert.throws(() => parseRule(JSON.stringify(both)), RuleError);
+
+  const position = baseRule();
+  (position["cast"] as Record<string, unknown>)["a"] = {
+    digest: DIGEST,
+    at: { epochId: "e", counter: "12" },
+  };
+  assert.ok(parseRule(JSON.stringify(position)));
+});