@wowok/agent-mcp 2.3.16 → 2.4.1

package/dist/knowledge/guard-translation.js

@@ -0,0 +1,1118 @@
+export const SEMANTIC_TO_SCHEMA_RULES = [
+    {
+        id: "P02",
+        pattern_name: "Query published object + system context",
+        data_source_combination: "Type1 + Type4",
+        semantic_intent: "Query published on-chain object fields and compare with system context",
+        match_keywords: ["paused", "published", "service status", "machine status", "paused", "published"],
+        schema_elements: {
+            root_type: "logic_equal / logic_and",
+            table_entries: [
+                { value_type: "Address", b_submission: false, purpose: "Published object address constant (Type1)" },
+            ],
+            context_nodes: [
+                { context_type: "Signer", purpose: "Optional: identity validation" },
+            ],
+            tree_structure: "logic_equal(query(<instruction>, object: { identifier: 0 }), identifier[1] or context(Signer))",
+        },
+        constraints: [
+            "The object_type of table[0] must match the target object type of the query instruction",
+            "The query return type must be compatible with the comparison object",
+            "The object must be published (published=true) to ensure fields are immutable",
+        ],
+        example: {
+            root: {
+                type: "logic_equal",
+                nodes: [
+                    { type: "query", query: "service.paused", object: { identifier: 0 }, parameters: [] },
+                    { type: "identifier", identifier: 1 },
+                ],
+            },
+            table: [
+                { identifier: 0, b_submission: false, value_type: "Address", value: "0xSERVICE", name: "Service object address" },
+                { identifier: 1, b_submission: false, value_type: "Bool", value: false, name: "Expected paused state (false=not paused)" },
+            ],
+        },
+    },
+    {
+        id: "P03",
+        pattern_name: "Identity check (single address)",
+        data_source_combination: "Type4 + Type1 constant",
+        semantic_intent: "Only a specific address can perform the operation",
+        match_keywords: ["only", "allow", "authorize", "identity", "specified address", "signer"],
+        schema_elements: {
+            root_type: "logic_equal",
+            table_entries: [
+                { value_type: "Address", b_submission: false, purpose: "Authorized address constant (Type1 constant)" },
+            ],
+            context_nodes: [
+                { context_type: "Signer", purpose: "Current transaction signer (Type4)" },
+            ],
+            tree_structure: "logic_equal(context(Signer), identifier[0])",
+        },
+        constraints: [
+            "root must be logic_equal (returns Bool)",
+            "table[0] must be Address type, b_submission=false",
+            "context(Signer) returns the current transaction signer address",
+        ],
+        example: {
+            root: {
+                type: "logic_equal",
+                nodes: [
+                    { type: "context", context: "Signer" },
+                    { type: "identifier", identifier: 0 },
+                ],
+            },
+            table: [
+                { identifier: 0, b_submission: false, value_type: "Address", value: "0xabc...", name: "Authorized operator address" },
+            ],
+        },
+    },
+    {
+        id: "P04",
+        pattern_name: "Identity check (whitelist)",
+        data_source_combination: "Type4 + Type1 constant (VecAddress)",
+        semantic_intent: "Addresses in the whitelist can perform this operation",
+        match_keywords: ["whitelist", "multiple addresses", "list", "allowlist", "roster"],
+        schema_elements: {
+            root_type: "vec_contains_address",
+            table_entries: [
+                { value_type: "VecAddress", b_submission: false, purpose: "Authorized address list (Type1 constant)" },
+            ],
+            context_nodes: [
+                { context_type: "Signer", purpose: "Signer being looked up (Type4)" },
+            ],
+            tree_structure: "vec_contains_address(identifier[0], context(Signer))",
+        },
+        constraints: [
+            "root vec_contains_address returns Bool",
+            "table[0] must be VecAddress type",
+            "context(Signer) is the element being looked up",
+        ],
+        example: {
+            root: {
+                type: "vec_contains_address",
+                nodes: [
+                    { type: "identifier", identifier: 0 },
+                    { type: "context", context: "Signer" },
+                ],
+            },
+            table: [
+                { identifier: 0, b_submission: false, value_type: "VecAddress", value: ["0xabc...", "0xdef..."], name: "Authorized address whitelist" },
+            ],
+        },
+    },
+    {
+        id: "P05",
+        pattern_name: "Time lock",
+        data_source_combination: "Type2 + Type4 + Type1 constant",
+        semantic_intent: "This operation can only be executed after waiting N milliseconds",
+        match_keywords: ["wait", "time", "lock", "delay", "hours", "days", "milliseconds"],
+        schema_elements: {
+            root_type: "logic_as_u256_greater_or_equal",
+            table_entries: [
+                { value_type: "Address", b_submission: true, purpose: "Source object address (e.g. Order, Type3) or constant (Type1)" },
+                { value_type: "U64", b_submission: false, purpose: "Lock duration (in milliseconds, 1000 for tests, Type1 constant)" },
+            ],
+            query_nodes: [
+                { query_name: "progress.current_time", object_type: "Progress", convert_witness: 100 },
+            ],
+            context_nodes: [
+                { context_type: "Clock", purpose: "Current on-chain timestamp (Type4)" },
+            ],
+            tree_structure: "logic_as_u256_greater_or_equal(context(Clock), calc_number_add(query(1272: progress.current_time, witness=100, identifier[0]), identifier[1]))",
+        },
+        constraints: [
+            "Time unit is milliseconds; use 1000ms for tests and adjust in production",
+            "convert_witness=100 (TypeOrderProgress) converts from Order to Progress",
+            "The object_type of table[0] must match the witness source type (Order)",
+            "calc_number_add returns U256, context(Clock) returns U64, auto-widened",
+            "Key: use progress.current_time(1272) rather than progress.session.forward.time(1271); the latter querying an unforwarded session returns 0 and disables the time lock",
+        ],
+        example: {
+            root: {
+                type: "logic_as_u256_greater_or_equal",
+                nodes: [
+                    { type: "context", context: "Clock" },
+                    {
+                        type: "calc_number_add",
+                        nodes: [
+                            {
+                                type: "query",
+                                query: "progress.current_time",
+                                object: { identifier: 0, convert_witness: 100 },
+                                parameters: [],
+                            },
+                            { type: "identifier", identifier: 1 },
+                        ],
+                    },
+                ],
+            },
+            table: [
+                { identifier: 0, b_submission: true, value_type: "Address", name: "Target Order address", object_type: "Order" },
+                { identifier: 1, b_submission: false, value_type: "U64", value: 1000, name: "Lock duration (milliseconds)" },
+            ],
+        },
+    },
+    {
+        id: "P06",
+        pattern_name: "Progress state check",
+        data_source_combination: "Type2 + Type1 constant",
+        semantic_intent: "The order progress must reach the specified node before this operation can be executed",
+        match_keywords: ["progress", "node", "state", "completed", "reach", "current node"],
+        schema_elements: {
+            root_type: "logic_equal",
+            table_entries: [
+                { value_type: "Address", b_submission: true, purpose: "Source Order address (Type3, witness source)" },
+                { value_type: "String", b_submission: false, purpose: "Expected node name (Type1 constant)" },
+            ],
+            query_nodes: [
+                { query_name: "progress.current", object_type: "Progress", convert_witness: 100 },
+            ],
+            tree_structure: "logic_equal(query(1253: progress.current, witness=100, identifier[0]), identifier[1])",
+        },
+        constraints: [
+            "query returns String; identifier[1] must be String type",
+            "logic_equal comparison on String is case-sensitive",
+            "For case-insensitive comparison, use logic_string_nocase_equal",
+            "convert_witness=100 (TypeOrderProgress) converts from Order",
+            "Type2 stacks on Type3: the source object Order is submitted (b_submission=true)",
+        ],
+        example: {
+            root: {
+                type: "logic_equal",
+                nodes: [
+                    {
+                        type: "query",
+                        query: "progress.current",
+                        object: { identifier: 0, convert_witness: 100 },
+                        parameters: [],
+                    },
+                    { type: "identifier", identifier: 1 },
+                ],
+            },
+            table: [
+                { identifier: 0, b_submission: true, value_type: "Address", name: "Target Order address", object_type: "Order" },
+                { identifier: 1, b_submission: false, value_type: "String", value: "Completed", name: "Expected progress node name" },
+            ],
+        },
+    },
+    {
+        id: "P07",
+        pattern_name: "One-time claim check",
+        data_source_combination: "Type3 + Type1 constant",
+        semantic_intent: "Users can only claim the reward once",
+        match_keywords: ["once", "claim", "duplicate", "already claimed", "claimed before"],
+        schema_elements: {
+            root_type: "logic_equal",
+            table_entries: [
+                { value_type: "Address", b_submission: true, purpose: "Reward object address (Type3, submitted)" },
+                { value_type: "U64", b_submission: false, purpose: "Expected historical claim count 0 (Type1 constant)" },
+            ],
+            query_nodes: [
+                { query_name: "reward.record.count", object_type: "Reward" },
+            ],
+            tree_structure: "logic_equal(query_reward_record_count(object: { identifier: 0 }, recipient: context(Signer)), identifier[1])",
+        },
+        constraints: [
+            "query_reward_record_count returns U64",
+            "Comparing count == 0 means no history record (can claim)",
+            "recipient defaults to context(Signer) to ensure the claimer's identity is bound",
+            "Type3 submitted objects must have constraint rules (here the constraint is count==0 and recipient=Signer)",
+        ],
+        example: {
+            root: {
+                type: "logic_equal",
+                nodes: [
+                    {
+                        type: "query_reward_record_count",
+                        object: { identifier: 0 },
+                    },
+                    { type: "identifier", identifier: 1 },
+                ],
+            },
+            table: [
+                { identifier: 0, b_submission: true, value_type: "Address", name: "Reward object address", object_type: "Reward" },
+                { identifier: 1, b_submission: false, value_type: "U64", value: 0, name: "Expected historical claim count (0)" },
+            ],
+        },
+    },
+    {
+        id: "P08",
+        pattern_name: "Submitted object identity validation",
+        data_source_combination: "Type3 + Type4",
+        semantic_intent: "Verify that the owner of the submitted object matches the signer",
+        match_keywords: ["ownership", "belonging", "customer", "submitted object", "order.customer"],
+        schema_elements: {
+            root_type: "logic_equal",
+            table_entries: [
+                { value_type: "Address", b_submission: true, purpose: "Submitted Order address (Type3)" },
+            ],
+            context_nodes: [
+                { context_type: "Signer", purpose: "Current signer (Type4), compared with order.customer" },
+            ],
+            query_nodes: [
+                { query_name: "order.customer", object_type: "Order" },
+            ],
+            tree_structure: "logic_equal(query(1550: order.customer, object: { identifier: 0 }), context(Signer))",
+        },
+        constraints: [
+            "query returns Address, context(Signer) returns Address, types compatible",
+            "Type3 submitted object constraint: indirectly binds submitter identity via order.customer == Signer",
+            "Ensures callers cannot submit other users' Order addresses",
+        ],
+        example: {
+            root: {
+                type: "logic_equal",
+                nodes: [
+                    {
+                        type: "query",
+                        query: "order.customer",
+                        object: { identifier: 0 },
+                        parameters: [],
+                    },
+                    { type: "context", context: "Signer" },
+                ],
+            },
+            table: [
+                { identifier: 0, b_submission: true, value_type: "Address", name: "User-submitted Order address", object_type: "Order" },
+            ],
+        },
+    },
+    {
+        id: "P09",
+        pattern_name: "Submitted object + witness derivation query",
+        data_source_combination: "Type3 + Type2 (source is Type3)",
+        semantic_intent: "User submits an Order and queries the Progress state via witness",
+        match_keywords: ["submit", "derive", "witness", "order to progress", "convert"],
+        schema_elements: {
+            root_type: "logic_equal / logic_and",
+            table_entries: [
+                { value_type: "Address", b_submission: true, purpose: "Submitted Order address (Type3, witness source)" },
+                { value_type: "String", b_submission: false, purpose: "Expected node name (Type1 constant)" },
+            ],
+            query_nodes: [
+                { query_name: "progress.current", object_type: "Progress", convert_witness: 100 },
+            ],
+            tree_structure: "logic_equal(query(1253: progress.current, object: { identifier: 0, convert_witness: 100 }), identifier[1])",
+        },
+        constraints: [
+            "Type2 stacks on Type3: the source object Order has b_submission=true",
+            "witness=100 (TypeOrderProgress) derives Progress from the submitted Order",
+            "query returns String; identifier[1] must be String type",
+            "Key: Type2 can stack on Type1 or Type3, depending on the source object's b_submission",
+        ],
+        example: {
+            root: {
+                type: "logic_equal",
+                nodes: [
+                    {
+                        type: "query",
+                        query: "progress.current",
+                        object: { identifier: 0, convert_witness: 100 },
+                        parameters: [],
+                    },
+                    { type: "identifier", identifier: 1 },
+                ],
+            },
+            table: [
+                { identifier: 0, b_submission: true, value_type: "Address", name: "User-submitted Order address", object_type: "Order" },
+                { identifier: 1, b_submission: false, value_type: "String", value: "Inspecting", name: "Expected progress node name" },
+            ],
+        },
+    },
+    {
+        id: "P10",
+        pattern_name: "Multi-condition combination (AND/OR)",
+        data_source_combination: "Type1 + Type2 + Type3 + Type4 (combination)",
+        semantic_intent: "Multiple conditions must all be satisfied (AND) or any one is satisfied (OR)",
+        match_keywords: ["and", "simultaneously", "all satisfied", "AND", "and also", "also need", "or", "any", "OR", "or", "one of"],
+        schema_elements: {
+            root_type: "logic_and / logic_or",
+            table_entries: [],
+            tree_structure: "logic_and/logic_or([condition1, condition2, ...]) — each condition can be any combination of P03-P09",
+        },
+        constraints: [
+            "All subnodes of logic_and/logic_or must return Bool",
+            "Subnode count 2-8 (MAX_MULTI_OPERANDS)",
+            "Each subcondition can be any node that returns Bool",
+            "Multi-condition combination is a container for other Patterns and does not stand alone",
+        ],
+        example: {
+            root: {
+                type: "logic_and",
+                nodes: [
+                    {},
+                    {},
+                ],
+            },
+        },
+    },
+    {
+        id: "P11",
+        pattern_name: "Entity registration check",
+        data_source_combination: "Type1 system address + Type3",
+        semantic_intent: "Verify that the user is registered in the entity registrar",
+        match_keywords: ["register", "entity", "EntityRegistrar", "member", "certify"],
+        schema_elements: {
+            root_type: "logic_and",
+            table_entries: [
+                { value_type: "Address", b_submission: false, purpose: "EntityRegistrar system address 0xaab (Type1 system address)" },
+                { value_type: "Address", b_submission: true, purpose: "User address (Type3, submitted)" },
+            ],
+            query_nodes: [
+                { query_name: "entity.registrar.records", object_type: "EntityRegistrar" },
+            ],
+            tree_structure: "logic_and(query(1760: entity.registrar.records, object: { identifier: 0 }, parameters: [identifier[1]]), ...)",
+        },
+        constraints: [
+            "EntityRegistrar address is fixed at 0xaab (system address)",
+            "EntityLinker address is fixed at 0xaaa",
+            "table[0] has is_system_address=true",
+            "query parameters must match the instruction definition",
+        ],
+        example: {
+            root: {
+                type: "logic_and",
+                nodes: [
+                    {
+                        type: "query",
+                        query: "entity.registrar.records",
+                        object: { identifier: 0 },
+                        parameters: [{ type: "identifier", identifier: 1 }],
+                    },
+                ],
+            },
+            table: [
+                { identifier: 0, b_submission: false, value_type: "Address", value: "0xaab", name: "EntityRegistrar system address" },
+                { identifier: 1, b_submission: true, value_type: "Address", name: "User address (submitted)" },
+            ],
+        },
+    },
+    {
+        id: "P12",
+        pattern_name: "Dynamic voting weight",
+        data_source_combination: "Type3 + Type4 + Type1 constant",
+        semantic_intent: "Voting weight equals the reputation score (extracted from submitted data)",
+        match_keywords: ["weight", "vote", "reputation", "score", "voting", "weight"],
+        schema_elements: {
+            root_type: "logic_and",
+            table_entries: [
+                { value_type: "Address", b_submission: true, purpose: "Voter address (Type3)" },
+                { value_type: "U64", b_submission: true, purpose: "Voter weight (Type3, extracted by GuardIdentifier)" },
+            ],
+            context_nodes: [
+                { context_type: "Signer", purpose: "Validate voter identity (Type4)" },
+            ],
+            query_nodes: [
+                { query_name: "entity.registrar.records", object_type: "EntityRegistrar" },
+            ],
+            tree_structure: "logic_and(identity check: logic_equal(context(Signer), identifier[0]), weight comparison: GuardIdentifier extracts identifier[1])",
+        },
+        constraints: [
+            "The table entry referenced by GuardIdentifier must be numeric (U8-U256)",
+            "b_submission must be true (weight is submitted at runtime by the voter)",
+            "Non-numeric types cause E_GUARD_IDENTIFIER_NOT_NUMBER error",
+            "Weight value is cast to u32",
+            "voting_guard scene special constraint: GuardIdentifier numeric",
+        ],
+        example: {
+            root: {
+                type: "logic_and",
+                nodes: [
+                    {},
+                    {},
+                ],
+            },
+            table: [
+                { identifier: 0, b_submission: true, value_type: "Address", name: "Voter address" },
+                { identifier: 1, b_submission: true, value_type: "U64", name: "Voter weight (extracted from reputation score)" },
+            ],
+        },
+    },
+    {
+        id: "P13",
+        pattern_name: "Repository data query",
+        data_source_combination: "Type1 + Type2",
+        semantic_intent: "Query Repository data and validate",
+        match_keywords: ["Repository", "storage", "data source", "weather", "external data", "oracle"],
+        schema_elements: {
+            root_type: "logic_and",
+            table_entries: [
+                { value_type: "Address", b_submission: false, purpose: "Repository address (Type1 constant)" },
+            ],
+            query_nodes: [
+                { query_name: "repository.data", object_type: "Repository" },
+            ],
+            tree_structure: "logic_and(query(1167: repository.data, object: { identifier: 0 }, parameters: [...]), [data validation condition])",
+        },
+        constraints: [
+            "The quote_guard authentication of query 1167 always has empty impack_list during the verify phase",
+            "Repository queries with quote_guard fail with IMPACK_GUARD_NOT_FOUND in the gen_passport flow",
+            "Only passes when quote_guard==None",
+            "rep semantics: repository.data query does not depend on runtime submission, so rep=true",
+        ],
+        example: {
+            root: {
+                type: "logic_and",
+                nodes: [
+                    {
+                        type: "query",
+                        query: "repository.data",
+                        object: { identifier: 0 },
+                        parameters: [{ type: "identifier", identifier: 1 }],
+                    },
+                    {},
+                ],
+            },
+            table: [
+                { identifier: 0, b_submission: false, value_type: "Address", value: "0xREPO", name: "Repository address" },
+            ],
+        },
+    },
+    {
+        id: "P14",
+        pattern_name: "Pure dependency combination",
+        data_source_combination: "None (rely only)",
+        semantic_intent: "Does not compute itself; fully depends on the results of other Guards",
+        match_keywords: ["depend", "combine", "reuse", "rely", "delegate"],
+        schema_elements: {
+            root_type: "logic_and / logic_or (minimized tautology)",
+            table_entries: [],
+            tree_structure: "root: minimized (e.g. context(Clock) >= 0, tautology) + rely: { guards: [...], logic_or: false }",
+        },
+        constraints: [
+            "Depended-on Guards must have rep=true (repository.data query does not depend on runtime submission)",
+            "rely.guards supports at most 4 (MAX_DEPENDED_COUNT)",
+            "Self-reference is forbidden",
+            "AND logic: all dependencies must pass; OR logic: any one passing is sufficient",
+        ],
+        example: {
+            root: {
+                type: "logic_as_u256_greater_or_equal",
+                nodes: [
+                    { type: "context", context: "Clock" },
+                    { type: "identifier", identifier: 0 },
+                ],
+            },
+            table: [
+                { identifier: 0, b_submission: false, value_type: "U64", value: 0, name: "Tautology baseline value (0)" },
+            ],
+            rely: { guards: ["guard_a", "guard_b"], logic_or: false },
+        },
+    },
+    {
+        id: "P15",
+        pattern_name: "Submission data retention pattern (retained_submission)",
+        data_source_combination: "Type3 + Type4 (submission + system context binding)",
+        semantic_intent: "Guard accepts runtime-submitted data but ensures it is trustworthy via Signer binding and type checking",
+        match_keywords: ["submit", "retain", "retained", "submission", "bind signer", "submission check"],
+        schema_elements: {
+            root_type: "logic_and",
+            table_entries: [
+                { value_type: "Address", b_submission: true, purpose: "Submitted object address (Type3, requires Signer binding)" },
+                { value_type: "U256", b_submission: true, purpose: "Submitted numeric value (e.g. amount, weight, requires range check)" },
+            ],
+            context_nodes: [
+                { context_type: "Signer", purpose: "Validate submitter identity to ensure submission data ownership" },
+            ],
+            tree_structure: "logic_and(logic_equal(context(Signer), query(..., signer_field)), logic_as_u256_greater_or_equal(identifier[1], identifier[2]))",
+        },
+        constraints: [
+            "The name of each b_submission=true entry must be a complete natural-language description (not a technical identifier)",
+            "The submitted object address should be bound to Signer (query the signer/owner field of the submitted object to validate ownership)",
+            "Submitted numeric values should have range checks (>= min, <= max)",
+            "Total table size must not exceed 40000 bytes",
+            "Total submission bytes must not exceed 256",
+        ],
+        example: {
+            root: {
+                type: "logic_and",
+                nodes: [
+                    {
+                        type: "logic_equal",
+                        nodes: [
+                            { type: "context", context: "Signer" },
+                            {
+                                type: "query",
+                                query: 1237,
+                                object: { identifier: 0 },
+                                parameters: [],
+                            },
+                        ],
+                    },
+                    {
+                        type: "logic_as_u256_greater_or_equal",
+                        nodes: [
+                            { type: "identifier", identifier: 1 },
+                            { type: "identifier", identifier: 2 },
+                        ],
+                    },
+                ],
+            },
+            table: [
+                { identifier: 0, b_submission: true, value_type: "Address", name: "Submitted Order object address; must belong to the current signer" },
+                { identifier: 1, b_submission: true, value_type: "U256", name: "Submitted amount (unit: MIST); must be >= minimum amount" },
+                { identifier: 2, b_submission: false, value_type: "U256", value: 1000000, name: "Minimum amount constant (1 MIST)" },
+            ],
+        },
+    },
+    {
+        id: "P16",
+        pattern_name: "Circular reference pattern (Guard references the host object itself)",
+        data_source_combination: "Type1 (host object as constant, using name instead of address)",
+        semantic_intent: "Guard binds to a Host Object while querying the Host Object's own fields; uses name reference to achieve circular binding",
+        match_keywords: ["circular reference", "self", "host", "host", "circular", "self-reference"],
+        schema_elements: {
+            root_type: "logic_equal / logic_and",
+            table_entries: [
+                { value_type: "Address", b_submission: false, purpose: "Host object name (SDK resolves to address at binding time)" },
+            ],
+            query_nodes: [
+                { query_name: "query_service_* / query_machine_*", object_type: "Service / Machine" },
+            ],
+            tree_structure: "logic_equal(query(<host_field_query>, object: { identifier: 0 }), identifier[1] or context(Signer))",
+        },
+        constraints: [
+            "The Host Object must not be published (bPublished=false) when creating and binding the Guard",
+            "Use the Host Object name (not address) in the table; the SDK resolves it at binding time",
+            "The Host Object can only be published after the Guard is bound",
+            "Guard verification only runs normally after the Host Object is published",
+            "Use guard2file to export Guard backups for easy rebuilding",
+        ],
+        example: {
+            root: {
+                type: "logic_equal",
+                nodes: [
+                    {
+                        type: "query",
+                        query: 1231,
+                        object: { identifier: 0 },
+                        parameters: [],
+                    },
+                    { type: "identifier", identifier: 1 },
+                ],
+            },
+            table: [
+                { identifier: 0, b_submission: false, value_type: "Address", value: "my_service", name: "Host Service name (circular reference, resolved by SDK at binding time)" },
+                { identifier: 1, b_submission: false, value_type: "Bool", value: false, name: "Expected Service paused state (false=not paused)" },
+            ],
+        },
+    },
+    {
+        id: "P17",
+        pattern_name: "Query parameter translation pattern (type conversion node combination)",
+        data_source_combination: "Type1/2 + type conversion (query parameter type translation)",
+        semantic_intent: "Guard queries parameters that require type conversion (e.g. Address → U64 timestamp key); uses convert_* nodes to translate",
+        match_keywords: ["type conversion", "translate", "convert", "timestamp key", "parameter translation", "address to u64"],
+        schema_elements: {
+            root_type: "logic_equal / logic_as_u256_greater_or_equal",
+            table_entries: [
+                { value_type: "Address", b_submission: false, purpose: "Query target object address (Type1/2)" },
+                { value_type: "U64", b_submission: false, purpose: "Comparison baseline value (e.g. timestamp threshold)" },
+            ],
+            query_nodes: [
+                { query_name: "query_repository_data / query_progress_history_*", object_type: "Repository / Progress" },
+            ],
+            tree_structure: "logic_as_u256_greater_or_equal(query(<query_with_converted_param>, object: { identifier: 0 }, parameters: [convert_number_address(identifier[1])]), identifier[2])",
+        },
+        constraints: [
+            "The query parameter type must match the parameters type defined in GUARDQUERY",
+            "If the table declares Address but the query requires U64, convert_number_address must be used to translate",
+            "The input type of convert_* nodes must be compatible with the child node's return type",
+            "The translated type must match the parameters definition of the query instruction",
+            "Use wowok_buildin_info info='guard instructions' to verify parameter types",
+        ],
+        example: {
+            root: {
+                type: "logic_as_u256_greater_or_equal",
+                nodes: [
+                    {
+                        type: "query",
+                        query: 1167,
+                        object: { identifier: 0 },
+                        parameters: [
+                            {
+                                type: "convert_number_address",
+                                nodes: [
+                                    { type: "identifier", identifier: 1 },
+                                ],
+                            },
+                        ],
+                    },
+                    { type: "identifier", identifier: 2 },
+                ],
+            },
+            table: [
+                { identifier: 0, b_submission: false, value_type: "Address", value: "0xrepo", name: "Repository address constant" },
+                { identifier: 1, b_submission: false, value_type: "U64", value: 1700000000000, name: "Timestamp key (U64, needs to be converted to Address for Repository query)" },
+                { identifier: 2, b_submission: false, value_type: "U256", value: 100, name: "Expected Repository data value" },
+            ],
+        },
+    },
+];
+export const SCHEMA_TO_SEMANTIC_RULES = [
+    { element_type: "node", type_name: "logic_equal", semantic: "Equality comparison (==), returns Bool. Accepts any type but both operands must be type-compatible", return_type: "Bool", child_constraints: "2 child nodes, types must be compatible" },
+    { element_type: "node", type_name: "logic_not", semantic: "Logical NOT (!), returns Bool", return_type: "Bool", child_constraints: "1 child node, must be Bool" },
+    { element_type: "node", type_name: "logic_and", semantic: "Logical AND; true if all child nodes are true", return_type: "Bool", child_constraints: "2-8 Bool child nodes (MAX_MULTI_OPERANDS)" },
+    { element_type: "node", type_name: "logic_or", semantic: "Logical OR; true if any child node is true", return_type: "Bool", child_constraints: "2-8 Bool child nodes" },
+    { element_type: "node", type_name: "logic_as_u256_greater", semantic: "Numeric greater than (>), auto-widened to U256", return_type: "Bool", child_constraints: "2 numeric child nodes (U8-U256 compatible)" },
+    { element_type: "node", type_name: "logic_as_u256_lesser", semantic: "Numeric less than (<)", return_type: "Bool", child_constraints: "2 numeric child nodes" },
+    { element_type: "node", type_name: "logic_as_u256_equal", semantic: "Numeric equality (==)", return_type: "Bool", child_constraints: "2 numeric child nodes" },
+    { element_type: "node", type_name: "logic_as_u256_greater_or_equal", semantic: "Numeric greater than or equal (>=)", return_type: "Bool", child_constraints: "2 numeric child nodes" },
+    { element_type: "node", type_name: "logic_as_u256_lesser_or_equal", semantic: "Numeric less than or equal (<=)", return_type: "Bool", child_constraints: "2 numeric child nodes" },
+    { element_type: "node", type_name: "logic_string_contains", semantic: "String contains (case-sensitive)", return_type: "Bool", child_constraints: "2 String child nodes" },
+    { element_type: "node", type_name: "logic_string_nocase_contains", semantic: "String contains (case-insensitive)", return_type: "Bool", child_constraints: "2 String child nodes" },
+    { element_type: "node", type_name: "logic_string_nocase_equal", semantic: "String equality (case-insensitive)", return_type: "Bool", child_constraints: "2 String child nodes" },
+    { element_type: "node", type_name: "identifier", semantic: "References the value of a table entry. The data source type depends on b_submission: false=Type1 constant, true=Type3 submitted", return_type: "Determined by table entry value_type", child_constraints: "No child nodes; requires identifier field to reference table", data_source_class: "Type1_OnChainConstant" },
+    { element_type: "node", type_name: "context", semantic: "Transaction context data (Type4 SystemContext). Signer=signer address, Clock=on-chain timestamp (U64), Guard=ObjectID of the Guard currently being verified", return_type: "Address (Signer/Guard) / U64 (Clock)", child_constraints: "No child nodes", data_source_class: "Type4_SystemContext" },
+    { element_type: "node", type_name: "query", semantic: "Queries on-chain object data. The data source type depends on object.convert_witness: present=Type2 (witness-derived), absent+constant=Type1, absent+submitted=Type3", return_type: "Determined by the query instruction", child_constraints: "Requires query + object + parameters fields", data_source_class: "Type1_OnChainConstant", discovery_tool: "wowok_buildin_info(info='guard instructions')" },
+    { element_type: "node", type_name: "calc_number_add", semantic: "Numeric addition", return_type: "U256", child_constraints: "2 numeric child nodes" },
+    { element_type: "node", type_name: "calc_number_subtract", semantic: "Numeric subtraction", return_type: "U256", child_constraints: "2 numeric child nodes" },
+    { element_type: "node", type_name: "calc_number_multiply", semantic: "Numeric multiplication", return_type: "U256", child_constraints: "2 numeric child nodes" },
+    { element_type: "node", type_name: "calc_number_divide", semantic: "Numeric division", return_type: "U256", child_constraints: "2 numeric child nodes" },
+    { element_type: "node", type_name: "calc_number_mod", semantic: "Numeric modulo", return_type: "U256", child_constraints: "2 numeric child nodes" },
+    { element_type: "node", type_name: "calc_string_length", semantic: "String length", return_type: "U64", child_constraints: "1 String child node" },
+    { element_type: "node", type_name: "calc_string_contains", semantic: "String contains (returns Bool)", return_type: "Bool", child_constraints: "2 String child nodes" },
+    { element_type: "node", type_name: "calc_string_nocase_contains", semantic: "String contains (case-insensitive, returns Bool)", return_type: "Bool", child_constraints: "2 String child nodes" },
+    { element_type: "node", type_name: "calc_string_nocase_equal", semantic: "String equality (case-insensitive, returns Bool)", return_type: "Bool", child_constraints: "2 String child nodes" },
+    { element_type: "node", type_name: "calc_string_indexof", semantic: "String find index", return_type: "U64", child_constraints: "2 String child nodes + order" },
+    { element_type: "node", type_name: "calc_string_nocase_indexof", semantic: "String find index (case-insensitive)", return_type: "U64", child_constraints: "2 String child nodes + order" },
+    { element_type: "node", type_name: "convert_number_address", semantic: "Number → Address conversion (e.g. timestamp to address)", return_type: "Address", child_constraints: "1 numeric child node" },
+    { element_type: "node", type_name: "convert_address_number", semantic: "Address → Number conversion", return_type: "U256", child_constraints: "1 Address child node" },
+    { element_type: "node", type_name: "convert_number_string", semantic: "Number → String conversion", return_type: "String", child_constraints: "1 numeric child node" },
+    { element_type: "node", type_name: "convert_string_number", semantic: "String → Number conversion", return_type: "U256", child_constraints: "1 String child node" },
+    { element_type: "node", type_name: "convert_safe_u8", semantic: "Safe conversion to U8 (errors on overflow)", return_type: "U8", child_constraints: "1 numeric child node" },
+    { element_type: "node", type_name: "convert_safe_u16", semantic: "Safe conversion to U16", return_type: "U16", child_constraints: "1 numeric child node" },
+    { element_type: "node", type_name: "convert_safe_u32", semantic: "Safe conversion to U32", return_type: "U32", child_constraints: "1 numeric child node" },
+    { element_type: "node", type_name: "convert_safe_u64", semantic: "Safe conversion to U64", return_type: "U64", child_constraints: "1 numeric child node" },
+    { element_type: "node", type_name: "convert_safe_u128", semantic: "Safe conversion to U128", return_type: "U128", child_constraints: "1 numeric child node" },
+    { element_type: "node", type_name: "convert_safe_u256", semantic: "Safe conversion to U256", return_type: "U256", child_constraints: "1 numeric child node" },
+    { element_type: "node", type_name: "value_type", semantic: "Returns the value's type identifier (U8) — used for dynamic type checking", return_type: "U8", child_constraints: "1 variable child node" },
+    { element_type: "node", type_name: "vec_length", semantic: "Vector length", return_type: "U64", child_constraints: "1 vec child node" },
+    { element_type: "node", type_name: "vec_contains_bool", semantic: "Whether the vector contains a Bool value", return_type: "Bool", child_constraints: "1 VecBool + 1 Bool" },
+    { element_type: "node", type_name: "vec_contains_address", semantic: "Whether the vector contains an Address (whitelist check)", return_type: "Bool", child_constraints: "1 VecAddress + 1 Address" },
+    { element_type: "node", type_name: "vec_contains_string", semantic: "Whether the vector contains a String", return_type: "Bool", child_constraints: "1 VecString + 1 String" },
+    { element_type: "node", type_name: "vec_contains_string_nocase", semantic: "Whether the vector contains a String (case-insensitive)", return_type: "Bool", child_constraints: "1 VecString + 1 String" },
+    { element_type: "node", type_name: "vec_contains_number", semantic: "Whether the vector contains a number", return_type: "Bool", child_constraints: "1 Vec* + 1 Number" },
+    { element_type: "node", type_name: "vec_indexof_bool", semantic: "Bool vector find index", return_type: "U64", child_constraints: "VecBool + Bool + order" },
+    { element_type: "node", type_name: "vec_indexof_address", semantic: "Address vector find index", return_type: "U64", child_constraints: "VecAddress + Address + order" },
+    { element_type: "node", type_name: "vec_indexof_string", semantic: "String vector find index", return_type: "U64", child_constraints: "VecString + String + order" },
+    { element_type: "node", type_name: "vec_indexof_string_nocase", semantic: "String vector find index (case-insensitive)", return_type: "U64", child_constraints: "VecString + String + order" },
+    { element_type: "node", type_name: "vec_indexof_number", semantic: "Numeric vector find index", return_type: "U64", child_constraints: "Vec* + Number + order" },
+    { element_type: "node", type_name: "query_reward_record_find", semantic: "Query reward claim records (returns the found record)", return_type: "Bool", child_constraints: "Requires object + recipient + where + find" },
+    { element_type: "node", type_name: "query_reward_record_count", semantic: "Query reward claim record count (U64)", return_type: "U64", child_constraints: "Requires object + recipient (optional)" },
+    { element_type: "node", type_name: "query_reward_record_exists", semantic: "Query whether a reward claim record exists (Bool)", return_type: "Bool", child_constraints: "Requires object + recipient (optional)" },
+    { element_type: "node", type_name: "query_progress_history_find", semantic: "Query whether a specified session exists in Progress history", return_type: "Bool", child_constraints: "Requires object + where + find" },
+    { element_type: "node", type_name: "query_progress_history_session_find", semantic: "Query a Progress session", return_type: "Bool", child_constraints: "Requires object + historyIdx + where + find" },
+    { element_type: "node", type_name: "query_progress_history_session_forward_find", semantic: "Query whether a specified forward exists in a Progress session", return_type: "Bool", child_constraints: "Requires object + historyIdx + sessionIdx + where + find" },
+    { element_type: "node", type_name: "query_progress_history_session_count", semantic: "Query the number of Progress sessions", return_type: "U64", child_constraints: "Requires object + historyIdx" },
+    { element_type: "node", type_name: "query_progress_history_session_forward_count", semantic: "Query the number of forwards in a Progress session", return_type: "U64", child_constraints: "Requires object + historyIdx + sessionIdx" },
+    { element_type: "node", type_name: "query_progress_history_session_forward_retained_submission_count", semantic: "Query the retained submission count of a forward in a Progress session", return_type: "U64", child_constraints: "Requires object + historyIdx + sessionIdx + forwardIdx" },
+    { element_type: "witness", type_name: "TypeOrderProgress", semantic: "Reads the order.progress field from an Order address to derive Progress (100, single hop)", data_source_class: "Type2_WitnessDerived", discovery_tool: "wowok_buildin_info(info='guard instructions')" },
+    { element_type: "witness", type_name: "TypeOrderMachine", semantic: "Reads the order.machine field from an Order address to derive Machine (101, single hop)", data_source_class: "Type2_WitnessDerived" },
+    { element_type: "witness", type_name: "TypeOrderService", semantic: "Reads the order.service field from an Order address to derive Service (102, single hop)", data_source_class: "Type2_WitnessDerived" },
+    { element_type: "witness", type_name: "TypeProgressMachine", semantic: "Reads the progress.machine field from a Progress address to derive Machine (103, single hop)", data_source_class: "Type2_WitnessDerived" },
+    { element_type: "witness", type_name: "TypeArbOrder", semantic: "Reads the arb.order field from an Arb address to derive Order (104, single hop)", data_source_class: "Type2_WitnessDerived" },
+    { element_type: "witness", type_name: "TypeArbArbitration", semantic: "Reads the arb.arbitration field from an Arb address to derive the parent Arbitration service (105, single hop)", data_source_class: "Type2_WitnessDerived" },
+    { element_type: "witness", type_name: "TypeArbProgress", semantic: "Derives from Arb in two hops: arb.order → order.progress (106, multi-hop)", data_source_class: "Type2_WitnessDerived" },
+    { element_type: "witness", type_name: "TypeArbMachine", semantic: "Derives from Arb in two hops: arb.order → order.machine (107, multi-hop)", data_source_class: "Type2_WitnessDerived" },
+    { element_type: "witness", type_name: "TypeArbService", semantic: "Derives from Arb in two hops: arb.order → order.service (108, multi-hop)", data_source_class: "Type2_WitnessDerived" },
+    { element_type: "context", type_name: "Signer", semantic: "Current transaction signer address (TransactionContext.sender())", return_type: "Address", data_source_class: "Type4_SystemContext" },
+    { element_type: "context", type_name: "Clock", semantic: "Current on-chain timestamp (reads timestamp_ms of WOW_CLOCK_OBJECT_ID 0x6)", return_type: "U64", data_source_class: "Type4_SystemContext" },
+    { element_type: "context", type_name: "Guard", semantic: "ObjectID of the Guard object currently being verified (self-reference, rare)", return_type: "Address", data_source_class: "Type4_SystemContext" },
+    { element_type: "table_entry", type_name: "Bool", semantic: "Boolean constant or submission" },
+    { element_type: "table_entry", type_name: "Address", semantic: "Address constant (Type1) or submission (Type3). Object address type" },
+    { element_type: "table_entry", type_name: "String", semantic: "String constant or submission" },
+    { element_type: "table_entry", type_name: "U8", semantic: "8-bit unsigned integer" },
+    { element_type: "table_entry", type_name: "U16", semantic: "16-bit unsigned integer" },
+    { element_type: "table_entry", type_name: "U32", semantic: "32-bit unsigned integer" },
+    { element_type: "table_entry", type_name: "U64", semantic: "64-bit unsigned integer (commonly used for timestamps)" },
+    { element_type: "table_entry", type_name: "U128", semantic: "128-bit unsigned integer" },
+    { element_type: "table_entry", type_name: "U256", semantic: "256-bit unsigned integer (auto-widening target for numeric operations)" },
+    { element_type: "table_entry", type_name: "VecAddress", semantic: "Address vector (used for whitelists, Type1 constant)" },
+    { element_type: "table_entry", type_name: "VecString", semantic: "String vector" },
+    { element_type: "table_entry", type_name: "VecU64", semantic: "U64 vector" },
+    { element_type: "table_entry", type_name: "VecU8", semantic: "U8 vector (raw bytes)" },
+    { element_type: "table_entry", type_name: "Value", semantic: "Dynamic type (19, first byte is the type identifier) — used for Repository data, EntityRegistrar records, Passport submission value" },
+    { element_type: "rely", type_name: "rely_and", semantic: "Depends on other Guards, AND logic (all must pass). Depended-on Guards must have rep=true", child_constraints: "At most 4 dependencies, each with rep=true (repository.data query does not depend on submission)" },
+    { element_type: "rely", type_name: "rely_or", semantic: "Depends on other Guards, OR logic (any one passing is sufficient). Depended-on Guards must have rep=true", child_constraints: "At most 4 dependencies, each with rep=true" },
+];
+export const GUARD_CONSTRAINT_RULES = [
+    {
+        id: "ROOT_01",
+        name: "root returns Bool",
+        description: "The Guard root node must return a Bool type",
+        category: "root",
+        phase: "creation",
+        validation_logic: "root.node_type must be in the allowedTypes list (logic_*, calc_string_contains, vec_contains_*, query_reward_record_exists, query[Bool return], identifier[Bool type])",
+        failure_message: "Guard root node must be an operation that returns Bool",
+        verification_location: "SDK buildNode(root, ValueType.Bool, ...)",
+        pitfall_number: 7,
+    },
+    {
+        id: "TABLE_01",
+        name: "identifier uniqueness",
+        description: "Each identifier in the table must be unique (0-255)",
+        category: "table",
+        phase: "creation",
+        validation_logic: "No duplicate identifiers in the table",
+        failure_message: "Duplicate table identifier",
+        verification_location: "SDK lodash groupBy",
+    },
+    {
+        id: "TABLE_02",
+        name: "identifier referential integrity",
+        description: "Every identifier node in the computation tree must exist in the table",
+        category: "table",
+        phase: "creation",
+        validation_logic: "Traverse the computation tree; each identifier node's index exists in the table",
+        failure_message: "Identifier not found in table",
+        verification_location: "SDK buildNode",
+        pitfall_number: 1,
+    },
+    {
+        id: "TABLE_03",
+        name: "Constant entries must have a value",
+        description: "Entries with b_submission=false must have a value field",
+        category: "table",
+        phase: "creation",
+        validation_logic: "All entries with b_submission=false have a non-empty value field",
+        failure_message: "Constant table entry must have a value",
+        verification_location: "SDK operate",
+    },
+    {
+        id: "TABLE_04",
+        name: "table size limit",
+        description: "At most 256 entries; serialized size must not exceed 40000 bytes",
+        category: "table",
+        phase: "creation",
+        validation_logic: "table.length <= 256 && serialize(table).length <= 40000",
+        failure_message: "Table exceeds size limit (256 entries or 40000 bytes)",
+        verification_location: "Move guard::new",
+    },
+    {
+        id: "TABLE_05",
+        name: "submission entry value is 1 byte (type code only)",
+        description: "Entries with b_submission=true have a serialized value of just 1 byte (the type code)",
+        category: "table",
+        phase: "creation",
+        validation_logic: "When b_submission=true, bcsValue.length === 1 and bcsValue[0] === valueType",
+        failure_message: "Submission table entry value must be 1 byte (type code only)",
+        verification_location: "native deserialize_constants",
+    },
+    {
+        id: "QUERY_01",
+        name: "query instruction valid",
+        description: "The query field of a query node must be a valid GUARDQUERY ID or name",
+        category: "query",
+        phase: "creation",
+        validation_logic: "The query field exists in GUARDQUERY (via isValidGuardQueryIdOrName)",
+        failure_message: "Invalid Guard query instruction",
+        verification_location: "SDK getGuardQueryInfo",
+        pitfall_number: 3,
+    },
+    {
+        id: "QUERY_02",
+        name: "query parameter count match",
+        description: "The number and types of parameters in a query node must match the instruction definition",
+        category: "query",
+        phase: "creation",
+        validation_logic: "parameters.length === instruction.parameters.length && type-compatible",
+        failure_message: "Query parameter count or type mismatch",
+        verification_location: "SDK buildNode",
+        pitfall_number: 3,
+    },
+    {
+        id: "QUERY_03",
+        name: "query return type compatible",
+        description: "The return type of a query node must be compatible with the parent node's expected type",
+        category: "query",
+        phase: "creation",
+        validation_logic: "checkType(query.return_type, parent.expected_type)",
+        failure_message: "Query return type incompatible with parent node",
+        verification_location: "SDK checkType",
+    },
+    {
+        id: "QUERY_04",
+        name: "query object identifier's value_type is Address",
+        description: "The table entry referenced by query node's object.identifier must have value_type of Address",
+        category: "query",
+        phase: "creation",
+        validation_logic: "table[object.identifier].value_type === Address",
+        failure_message: "Query object identifier must reference an Address-type table entry",
+        verification_location: "SDK buildNode L603-609",
+    },
+    {
+        id: "WITNESS_01",
+        name: "witness type valid",
+        description: "convert_witness must be a valid WitnessType (100-108)",
+        category: "witness",
+        phase: "creation",
+        validation_logic: "The witness value is within the range allowed by WitnessTypeSchema (100-108)",
+        failure_message: "Invalid witness type",
+        verification_location: "SDK isWitnessType",
+        pitfall_number: 4,
+    },
+    {
+        id: "WITNESS_02",
+        name: "witness target matches query objectType",
+        description: "The witness's target type must match the query instruction's objectType",
+        category: "witness",
+        phase: "creation",
+        validation_logic: "witness.target_type === instruction.objectType",
+        failure_message: "Witness target type does not match query object type",
+        verification_location: "SDK buildNode L613-619",
+        pitfall_number: 4,
+    },
+    {
+        id: "WITNESS_03",
+        name: "witness source matches tableItem object_type",
+        description: "The witness's source type must match the object_type declared in the table entry (if declared)",
+        category: "witness",
+        phase: "creation",
+        validation_logic: "table[identifier].object_type === witness.source_type (if tableItem.object_type is declared)",
+        failure_message: "Witness source type does not match table entry object_type",
+        verification_location: "SDK buildNode L622-631",
+        pitfall_number: 4,
+    },
+    {
+        id: "RELY_01",
+        name: "rely dependency count ≤ 4",
+        description: "rely.guards supports at most 4 dependencies (MAX_DEPENDED_COUNT)",
+        category: "rely",
+        phase: "creation",
+        validation_logic: "rely.guards.length <= 4",
+        failure_message: "Rely dependencies exceed limit (4)",
+        verification_location: "SDK reliesAdd",
+    },
+    {
+        id: "RELY_02",
+        name: "rely dependency rep=true",
+        description: "All rely-depended Guards must have rep=true (repository.data query does not depend on runtime submission)",
+        category: "rely",
+        phase: "creation",
+        validation_logic: "Query each depended Guard's rep field; must be true",
+        failure_message: "Rely dependency has rep=false (not standalone)",
+        verification_location: "Move guard::relies_add",
+        pitfall_number: 8,
+    },
+    {
+        id: "RELY_03",
+        name: "rely forbids self-reference",
+        description: "A Guard cannot depend on itself",
+        category: "rely",
+        phase: "creation",
+        validation_logic: "rely.guards does not contain the current Guard's address",
+        failure_message: "Guard cannot rely on itself",
+        verification_location: "SDK reliesAdd",
+    },
+    {
+        id: "BINDING_01",
+        name: "voting_guard GuardIdentifier numeric",
+        description: "The table entry referenced by Arbitration voting_guard's GuardIdentifier must be of a numeric type",
+        category: "binding",
+        phase: "creation",
+        validation_logic: "If binding=voting_guard, the table entry pointed to by GuardIdentifier has value_type in [U8,U16,U32,U64,U128,U256]",
+        failure_message: "E_GUARD_IDENTIFIER_NOT_NUMBER: voting_guard weight must be numeric",
+        verification_location: "Move Arbitration",
+        pitfall_number: 9,
+    },
+    {
+        id: "BINDING_02",
+        name: "Repository id_from_submission Address",
+        description: "The table entry referenced by Repository write_guard's id_from_submission must be of Address type",
+        category: "binding",
+        phase: "creation",
+        validation_logic: "If binding=write_guard and id_from_submission is set, table[id_from_submission].value_type === Address",
+        failure_message: "Repository id_from_submission must be Address type",
+        verification_location: "Move Repository",
+    },
+    {
+        id: "BINDING_03",
+        name: "Repository data_from_submission type match",
+        description: "The table entry referenced by Repository write_guard's data_from_submission must match the Repository value_type",
+        category: "binding",
+        phase: "creation",
+        validation_logic: "If binding=write_guard and data_from_submission is set, table[data_from_submission].value_type === Repository.value_type",
+        failure_message: "Repository data_from_submission type mismatch",
+        verification_location: "Move Repository",
+    },
+    {
+        id: "INPUT_01",
+        name: "root byte stream non-empty",
+        description: "The serialized byte stream of root cannot be empty",
+        category: "input",
+        phase: "creation",
+        validation_logic: "input.length > 0",
+        failure_message: "Input cannot be empty",
+        verification_location: "SDK newGuard",
+    },
+    {
+        id: "INPUT_02",
+        name: "root byte stream ≤ MAX_INPUT_SIZE",
+        description: "The serialized byte stream of root must not exceed MAX_INPUT_SIZE",
+        category: "input",
+        phase: "creation",
+        validation_logic: "input.length <= MAX_INPUT_SIZE",
+        failure_message: "Input size exceeds maximum limit",
+        verification_location: "SDK newGuard",
+    },
+    {
+        id: "IMMUTABLE_01",
+        name: "Guard immutable=true after creation",
+        description: "After creation, a Guard cannot be modified or deleted (CREATE-only)",
+        category: "immutable",
+        phase: "creation",
+        validation_logic: "After guard::create, the immutable field is set to true",
+        failure_message: "Guard is immutable after creation",
+        verification_location: "Move guard::create",
+    },
+    {
+        id: "RUN_IMMUTABLE_01",
+        name: "Guard must be immutable=true to verify",
+        description: "At runtime verification, the Guard must be frozen (immutable=true)",
+        category: "immutable",
+        phase: "runtime",
+        validation_logic: "guard.immutable === true",
+        failure_message: "Guard must be immutable to verify",
+        verification_location: "native verify_guard L497-506",
+    },
+    {
+        id: "RUN_SUB_01",
+        name: "submission type byte matches table declaration",
+        description: "The value[0] (type byte) of submission must match the value_type declared in the table",
+        category: "table",
+        phase: "runtime",
+        validation_logic: "submission_value[0] === table[identifier].value_type",
+        failure_message: "Submission type byte does not match table declaration",
+        verification_location: "native parse_table_items L306",
+    },
+    {
+        id: "RUN_SUB_02",
+        name: "table entries with b_submission=true must be found in submission",
+        description: "All table entries declared as submitted must have corresponding submission data",
+        category: "table",
+        phase: "runtime",
+        validation_logic: "forall identifier in table where b_submission=true: identifier in submission_map",
+        failure_message: "Missing submission for declared b_submission=true table entry",
+        verification_location: "native parse_table_items L301-321",
+    },
+    {
+        id: "RUN_SUB_03",
+        name: "submission total bytes ≤ MAX_SUBMISSION_SIZE (256)",
+        description: "The total bytes of all data submitted at runtime must not exceed 256",
+        category: "table",
+        phase: "runtime",
+        validation_logic: "total_submission_bytes <= 256",
+        failure_message: "Submission exceeds MAX_SUBMISSION_SIZE (256 bytes)",
+        verification_location: "Move verify L252",
+    },
+    {
+        id: "RUN_WITNESS_01",
+        name: "witness derivation source object must have the required relation field",
+        description: "When witness conversion occurs, the source object must contain the relation field needed for derivation",
+        category: "witness",
+        phase: "runtime",
+        validation_logic: "The source object exists and contains the field required for witness derivation (e.g. order.progress field is non-empty)",
+        failure_message: "Witness source object missing required field for derivation",
+        verification_location: "native convert_witness",
+    },
+    {
+        id: "RUN_WITNESS_02",
+        name: "witness-derived target object must exist",
+        description: "The target object derived by witness must exist on-chain",
+        category: "witness",
+        phase: "runtime",
+        validation_logic: "The derived target object ID exists on-chain",
+        failure_message: "Witness derived target object does not exist",
+        verification_location: "native convert_witness",
+    },
+    {
+        id: "RUN_QUERY_01",
+        name: "query target object must exist and type match",
+        description: "The target object of a query must exist on-chain and its type must match",
+        category: "query",
+        phase: "runtime",
+        validation_logic: "Target object exists && object type matches query.objectType",
+        failure_message: "Query target object does not exist or type mismatch",
+        verification_location: "native process_object_query",
+    },
+    {
+        id: "RUN_IMPACK_01",
+        name: "at least one impack guard",
+        description: "Passport verification requires at least one impack guard",
+        category: "runtime",
+        phase: "runtime",
+        validation_logic: "impack_list.length >= 1 (note: impack_list is always empty during verify phase; this constraint is checked in result_for_permission phase)",
+        failure_message: "No impack guard found",
+        verification_location: "Move verify L281",
+    },
+    {
+        id: "RUN_IMPACK_02",
+        name: "impack guard failure fails the entire passport",
+        description: "If any impack guard verification fails, the entire passport verification fails",
+        category: "runtime",
+        phase: "runtime",
+        validation_logic: "forall guard in impack_list: guard.result === true",
+        failure_message: "Impack guard verification failed",
+        verification_location: "Move verify L270-275",
+    },
+    {
+        id: "RUN_TX_01",
+        name: "Passport tx_hash must match the current transaction",
+        description: "The tx_hash recorded in the Passport must match the hash of the currently executing transaction",
+        category: "runtime",
+        phase: "runtime",
+        validation_logic: "passport.tx_hash === current_tx_hash",
+        failure_message: "Passport tx_hash does not match current transaction",
+        verification_location: "Move verify L231",
+    },
+    {
+        id: "RUN_RELY_01",
+        name: "rely guard must have been added to passport",
+        description: "Guards relied on must have been registered in the passport",
+        category: "rely",
+        phase: "runtime",
+        validation_logic: "forall guard in rely.guards: guard in passport.relies",
+        failure_message: "Rely guard not added to passport",
+        verification_location: "Move calculate_relies_result",
+    },
+];
+export function matchSemanticPattern(userIntent) {
+    const lower = userIntent.toLowerCase();
+    return SEMANTIC_TO_SCHEMA_RULES.filter((rule) => rule.match_keywords.some((kw) => lower.includes(kw.toLowerCase())));
+}
+export function explainNode(nodeType) {
+    return SCHEMA_TO_SEMANTIC_RULES.find((r) => r.element_type === "node" && r.type_name === nodeType);
+}
+export function explainWitness(witnessType) {
+    const witnessMap = {
+        100: "TypeOrderProgress",
+        101: "TypeOrderMachine",
+        102: "TypeOrderService",
+        103: "TypeProgressMachine",
+        104: "TypeArbOrder",
+        105: "TypeArbArbitration",
+        106: "TypeArbProgress",
+        107: "TypeArbMachine",
+        108: "TypeArbService",
+    };
+    const name = witnessMap[witnessType];
+    return SCHEMA_TO_SEMANTIC_RULES.find((r) => r.element_type === "witness" && r.type_name === name);
+}
+export function explainContext(contextType) {
+    return SCHEMA_TO_SEMANTIC_RULES.find((r) => r.element_type === "context" && r.type_name === contextType);
+}
+export function getConstraintsByCategory(category) {
+    return GUARD_CONSTRAINT_RULES.filter((r) => r.category === category);
+}
+export function getConstraintsByPhase(phase) {
+    return GUARD_CONSTRAINT_RULES.filter((r) => r.phase === phase);
+}
+export function getPatternById(id) {
+    return SEMANTIC_TO_SCHEMA_RULES.find((r) => r.id === id);
+}
+export function getDataSourceCombinations() {
+    return [...new Set(SEMANTIC_TO_SCHEMA_RULES.map((r) => r.data_source_combination))];
+}