create-feltdb 0.11.2 → 0.11.3

package/dist/server-source/crates/feltdb/tests/semantic_decision.rs

@@ -0,0 +1,1165 @@
+use feltdb::authorization::{AuthorizationRequest, Subject};
+use feltdb::semantic_decision::{
+    authorize_context, decide_record, deterministic_request_key, execute_decision_batch,
+    execute_decision_transport, jev, run_choice_diagnostics, run_decision_benchmark,
+    DecisionAuthorizationConfig, DecisionAuthorizationDecision, DecisionAuthorizationGate,
+    DecisionBatch, DecisionBatchDecision, DecisionDefinition, DecisionError, DecisionOptions,
+    DecisionRecordRef, DecisionRequest, DecisionResult, DecisionRuntime, DecisionRuntimeMetadata,
+    DecisionStatus, DecisionTransportAuthorization, DecisionTransportExecutionRequest,
+    DecisionTransportRuntime, DeterministicDecisionRuntime, WeightedOption,
+    DEFAULT_DECISION_COLLECTION,
+};
+use feltdb::FeltDb;
+use serde_json::{json, Value};
+use std::collections::{BTreeMap, BTreeSet};
+use std::sync::atomic::{AtomicUsize, Ordering};
+use std::sync::{Arc, Mutex};
+use tempfile::TempDir;
+
+#[derive(Clone)]
+struct RecordingRuntime {
+    metadata: DecisionRuntimeMetadata,
+    calls: Arc<Mutex<Vec<DecisionRequest>>>,
+    invocations: Arc<AtomicUsize>,
+}
+
+impl RecordingRuntime {
+    fn new(model_revision: &str, prompt_revision: &str) -> Self {
+        Self {
+            metadata: DecisionRuntimeMetadata {
+                runtime: "deterministic".into(),
+                model: Some("deterministic-runtime".into()),
+                model_revision: Some(model_revision.into()),
+                prompt_revision: Some(prompt_revision.into()),
+                execution_method: Some(feltdb::DecisionExecutionMethod::Logit),
+                decision_schema_revision: Some("semantic-decision-v1".into()),
+            },
+            calls: Arc::new(Mutex::new(Vec::new())),
+            invocations: Arc::new(AtomicUsize::new(0)),
+        }
+    }
+
+    fn calls(&self) -> Vec<DecisionRequest> {
+        self.calls.lock().expect("calls").clone()
+    }
+
+    fn invocations(&self) -> usize {
+        self.invocations.load(Ordering::SeqCst)
+    }
+}
+
+impl DecisionRuntime for RecordingRuntime {
+    fn metadata(&self) -> DecisionRuntimeMetadata {
+        self.metadata.clone()
+    }
+
+    fn decide(&self, request: &DecisionRequest) -> Result<DecisionResult, DecisionError> {
+        self.invocations.fetch_add(1, Ordering::SeqCst);
+        self.calls.lock().expect("calls").push(request.clone());
+        let context = request.context().as_object().cloned().unwrap_or_default();
+        Ok(match request {
+            DecisionRequest::Binary { .. } => {
+                let decision = context
+                    .get("employmentType")
+                    .and_then(Value::as_str)
+                    .is_some_and(|value| matches!(value, "remote" | "hybrid"));
+                DecisionResult::Binary {
+                    decision,
+                    option_mass: if decision { 0.9 } else { 0.8 },
+                    supporting_fields: vec!["employmentType".into()],
+                }
+            }
+            DecisionRequest::Choice { options, .. } => {
+                let selected = context
+                    .get("actionHint")
+                    .and_then(Value::as_str)
+                    .unwrap_or(options.first().map(String::as_str).unwrap_or("approve"))
+                    .to_string();
+                DecisionResult::Choice {
+                    option_mass: 0.85,
+                    selected: selected.clone(),
+                    options: options
+                        .iter()
+                        .map(|value| WeightedOption {
+                            value: value.clone(),
+                            probability: if value == &selected {
+                                0.85
+                            } else {
+                                0.15 / ((options.len() - 1).max(1) as f64)
+                            },
+                        })
+                        .collect(),
+                    supporting_fields: vec!["actionHint".into()],
+                }
+            }
+            DecisionRequest::Score { levels, .. } => {
+                let selected = context
+                    .get("urgency")
+                    .and_then(Value::as_str)
+                    .unwrap_or(levels.first().map(String::as_str).unwrap_or("low"))
+                    .to_string();
+                DecisionResult::Score {
+                    option_mass: 0.88,
+                    selected: selected.clone(),
+                    levels: levels
+                        .iter()
+                        .map(|value| WeightedOption {
+                            value: value.clone(),
+                            probability: if value == &selected {
+                                0.88
+                            } else {
+                                0.12 / ((levels.len() - 1).max(1) as f64)
+                            },
+                        })
+                        .collect(),
+                    supporting_fields: vec!["urgency".into()],
+                }
+            }
+        })
+    }
+}
+
+struct StaticGate {
+    allowed: BTreeSet<String>,
+    requests: Arc<Mutex<Vec<AuthorizationRequest>>>,
+}
+
+impl StaticGate {
+    fn new(fields: &[&str]) -> Self {
+        Self {
+            allowed: fields.iter().map(|field| (*field).to_string()).collect(),
+            requests: Arc::new(Mutex::new(Vec::new())),
+        }
+    }
+}
+
+impl DecisionAuthorizationGate for StaticGate {
+    fn check(
+        &self,
+        request: &AuthorizationRequest,
+    ) -> Result<DecisionAuthorizationDecision, DecisionError> {
+        self.requests
+            .lock()
+            .expect("requests")
+            .push(request.clone());
+        let field = request
+            .resource
+            .uri
+            .split('/')
+            .next_back()
+            .unwrap_or_default()
+            .to_string();
+        Ok(DecisionAuthorizationDecision {
+            allowed: self.allowed.contains(&field),
+            decision_id: Some(format!("decision-{field}")),
+        })
+    }
+}
+
+fn authorization_config() -> DecisionAuthorizationConfig {
+    DecisionAuthorizationConfig {
+        principal: Some(feltdb::DecisionPrincipal {
+            subject: Subject::Service("reporting-service".into()),
+            tenant_id: "tenant-a".into(),
+            application_id: "people-directory".into(),
+            capability: "state:read".into(),
+        }),
+    }
+}
+
+fn memory_db(name: &str) -> FeltDb {
+    let path = std::env::temp_dir().join(format!(
+        "feltdb-semantic-decision-{name}-{}.log",
+        std::time::SystemTime::now()
+            .duration_since(std::time::UNIX_EPOCH)
+            .expect("time")
+            .as_nanos()
+    ));
+    FeltDb::open(path).expect("db")
+}
+
+fn insert_person(db: &FeltDb, id: &str, record: Value) {
+    db.insert(&format!("people:{id}"), record).expect("insert");
+}
+
+fn update_person(db: &FeltDb, id: &str, record: Value) {
+    db.update(&format!("people:{id}"), record).expect("update");
+}
+
+fn judgment_rows(db: &FeltDb) -> Vec<feltdb::DecisionJudgmentRecord> {
+    db.capability(DEFAULT_DECISION_COLLECTION)
+        .find(|_: &feltdb::DecisionJudgmentRecord| true)
+        .expect("judgments")
+}
+
+#[test]
+fn binary_choice_and_score_decisions_are_valid_and_authoritative() {
+    let db = memory_db("valid");
+    insert_person(
+        &db,
+        "p-1",
+        json!({
+            "id": "p-1",
+            "__version": 1,
+            "publicRole": "Staff Backend Engineer",
+            "employmentType": "remote",
+            "actionHint": "review",
+            "urgency": "high",
+        }),
+    );
+    let runtime = RecordingRuntime::new("deterministic-v1", "prompt-v1");
+    let target = DecisionRecordRef {
+        collection: "people".into(),
+        record_id: "p-1".into(),
+    };
+
+    let binary = jev(
+        &db,
+        &target,
+        "could work from home",
+        &runtime,
+        &DecisionOptions::default(),
+        None,
+    )
+    .expect("binary");
+    let choice = decide_record(
+        &db,
+        &target,
+        &DecisionDefinition::Choice {
+            question: "Which action should be taken?".into(),
+            options: vec!["approve".into(), "reject".into(), "review".into()],
+        },
+        &runtime,
+        &DecisionOptions::default(),
+        None,
+    )
+    .expect("choice");
+    let score = decide_record(
+        &db,
+        &target,
+        &DecisionDefinition::Score {
+            question: "What is the urgency?".into(),
+            levels: vec!["low".into(), "medium".into(), "high".into()],
+        },
+        &runtime,
+        &DecisionOptions::default(),
+        None,
+    )
+    .expect("score");
+
+    assert!(matches!(
+        &binary.result,
+        DecisionResult::Binary { decision: true, .. }
+    ));
+    assert!(
+        matches!(choice.result, DecisionResult::Choice { ref selected, .. } if selected == "review")
+    );
+    assert!(
+        matches!(score.result, DecisionResult::Score { ref selected, .. } if selected == "high")
+    );
+    assert_eq!(runtime.invocations(), 3);
+    assert_eq!(judgment_rows(&db).len(), 3);
+    assert_eq!(
+        binary.provenance.execution_method,
+        Some(feltdb::DecisionExecutionMethod::Logit)
+    );
+    assert_eq!(
+        binary.provenance.decision_schema_revision.as_deref(),
+        Some("semantic-decision-v1")
+    );
+}
+
+#[test]
+fn invalid_runtime_results_fail_closed() {
+    let db = memory_db("invalid-results");
+    insert_person(
+        &db,
+        "p-1",
+        json!({"id":"p-1","__version":1,"employmentType":"remote","actionHint":"review","urgency":"medium"}),
+    );
+    let target = DecisionRecordRef {
+        collection: "people".into(),
+        record_id: "p-1".into(),
+    };
+
+    struct InvalidRuntime(&'static str);
+    impl DecisionRuntime for InvalidRuntime {
+        fn metadata(&self) -> DecisionRuntimeMetadata {
+            DecisionRuntimeMetadata {
+                runtime: "broken".into(),
+                model: Some("broken".into()),
+                model_revision: Some("broken-v1".into()),
+                prompt_revision: Some("broken-prompt".into()),
+                execution_method: None,
+                decision_schema_revision: None,
+            }
+        }
+
+        fn decide(&self, _request: &DecisionRequest) -> Result<DecisionResult, DecisionError> {
+            Ok(match self.0 {
+                "option" => DecisionResult::Choice {
+                    selected: "maybe".into(),
+                    options: vec![
+                        WeightedOption {
+                            value: "approve".into(),
+                            probability: 0.5,
+                        },
+                        WeightedOption {
+                            value: "reject".into(),
+                            probability: 0.5,
+                        },
+                    ],
+                    option_mass: 0.5,
+                    supporting_fields: vec![],
+                },
+                _ => DecisionResult::Score {
+                    selected: "high".into(),
+                    levels: vec![
+                        WeightedOption {
+                            value: "low".into(),
+                            probability: 0.4,
+                        },
+                        WeightedOption {
+                            value: "medium".into(),
+                            probability: 0.4,
+                        },
+                        WeightedOption {
+                            value: "high".into(),
+                            probability: 0.4,
+                        },
+                    ],
+                    option_mass: 0.4,
+                    supporting_fields: vec![],
+                },
+            })
+        }
+    }
+
+    let invalid_option = decide_record(
+        &db,
+        &target,
+        &DecisionDefinition::Choice {
+            question: "Which action should be taken?".into(),
+            options: vec!["approve".into(), "reject".into(), "review".into()],
+        },
+        &InvalidRuntime("option"),
+        &DecisionOptions::default(),
+        None,
+    )
+    .expect_err("invalid option");
+    assert_eq!(invalid_option.code, "DECISION_INVALID_OPTION");
+
+    let invalid_distribution = decide_record(
+        &db,
+        &target,
+        &DecisionDefinition::Score {
+            question: "What is the urgency?".into(),
+            levels: vec!["low".into(), "medium".into(), "high".into()],
+        },
+        &InvalidRuntime("distribution"),
+        &DecisionOptions::default(),
+        None,
+    )
+    .expect_err("invalid distribution");
+    assert_eq!(invalid_distribution.code, "DECISION_INVALID_DISTRIBUTION");
+}
+
+#[test]
+fn authorization_filters_context_before_runtime_and_evidence() {
+    let db = memory_db("authorization");
+    let secret = "SENTINEL-remote-every-day";
+    insert_person(
+        &db,
+        "p-1",
+        json!({
+            "id":"p-1",
+            "__version":1,
+            "publicRole":"Staff Backend Engineer",
+            "employmentType":"office",
+            "privateNotes": secret
+        }),
+    );
+    let runtime = RecordingRuntime::new("deterministic-v1", "prompt-v1");
+    let gate = StaticGate::new(&["publicRole", "employmentType"]);
+    let result = jev(
+        &db,
+        &DecisionRecordRef {
+            collection: "people".into(),
+            record_id: "p-1".into(),
+        },
+        "could work from home",
+        &runtime,
+        &DecisionOptions::default(),
+        Some((&gate, &authorization_config())),
+    )
+    .expect("jev");
+
+    let calls = runtime.calls();
+    assert_eq!(calls.len(), 1);
+    let payload = serde_json::to_string(&calls).expect("serialize calls");
+    assert!(!payload.contains(secret));
+    assert!(!payload.contains("privateNotes"));
+    let request_uris: Vec<String> = gate
+        .requests
+        .lock()
+        .expect("requests")
+        .iter()
+        .map(|request| request.resource.uri.clone())
+        .collect();
+    assert_eq!(
+        request_uris,
+        vec![
+            "flow://people-directory/people/p-1/employmentType".to_string(),
+            "flow://people-directory/people/p-1/privateNotes".to_string(),
+            "flow://people-directory/people/p-1/publicRole".to_string(),
+        ]
+    );
+    assert_eq!(
+        result.evidence[0].state.withheld_fields,
+        vec!["privateNotes".to_string()]
+    );
+}
+
+#[test]
+fn cache_reuse_invalidation_and_supersession_follow_authorized_state() {
+    let db = memory_db("cache");
+    insert_person(
+        &db,
+        "p-1",
+        json!({
+            "id":"p-1",
+            "__version":1,
+            "publicRole":"Staff Backend Engineer",
+            "employmentType":"office",
+            "lastSeenAt":"2026-01-01"
+        }),
+    );
+    let runtime = RecordingRuntime::new("deterministic-v1", "prompt-v1");
+    let target = DecisionRecordRef {
+        collection: "people".into(),
+        record_id: "p-1".into(),
+    };
+    let options = DecisionOptions {
+        fields: Some(vec!["publicRole".into(), "employmentType".into()]),
+        ..DecisionOptions::default()
+    };
+
+    let first = jev(
+        &db,
+        &target,
+        "could work from home",
+        &runtime,
+        &options,
+        None,
+    )
+    .expect("first");
+    let second = jev(
+        &db,
+        &target,
+        "could work from home",
+        &runtime,
+        &options,
+        None,
+    )
+    .expect("second");
+    assert!(!first.cached);
+    assert!(second.cached);
+    assert_eq!(runtime.invocations(), 1);
+
+    update_person(
+        &db,
+        "p-1",
+        json!({
+            "id":"p-1",
+            "__version":2,
+            "publicRole":"Staff Backend Engineer",
+            "employmentType":"office",
+            "lastSeenAt":"2026-09-18"
+        }),
+    );
+    let after_irrelevant = jev(
+        &db,
+        &target,
+        "could work from home",
+        &runtime,
+        &options,
+        None,
+    )
+    .expect("irrelevant");
+    assert!(after_irrelevant.cached);
+    assert_eq!(runtime.invocations(), 1);
+
+    update_person(
+        &db,
+        "p-1",
+        json!({
+            "id":"p-1",
+            "__version":3,
+            "publicRole":"Staff Backend Engineer",
+            "employmentType":"remote",
+            "lastSeenAt":"2026-09-18"
+        }),
+    );
+    let after_relevant = jev(
+        &db,
+        &target,
+        "could work from home",
+        &runtime,
+        &options,
+        None,
+    )
+    .expect("relevant");
+    assert!(!after_relevant.cached);
+    assert_eq!(runtime.invocations(), 2);
+    let judgments = judgment_rows(&db);
+    assert_eq!(judgments.len(), 2);
+    assert!(judgments
+        .iter()
+        .any(|row| row.status == DecisionStatus::Superseded));
+    assert!(judgments
+        .iter()
+        .any(|row| row.status == DecisionStatus::Active));
+}
+
+#[test]
+fn decision_schema_and_runtime_revisions_invalidate_cache_identity() {
+    let db = memory_db("identity");
+    insert_person(
+        &db,
+        "p-1",
+        json!({"id":"p-1","__version":1,"actionHint":"approve","urgency":"medium"}),
+    );
+    let target = DecisionRecordRef {
+        collection: "people".into(),
+        record_id: "p-1".into(),
+    };
+    let runtime_a = RecordingRuntime::new("deterministic-v1", "prompt-v1");
+    let runtime_b = RecordingRuntime::new("deterministic-v2", "prompt-v1");
+
+    let first = decide_record(
+        &db,
+        &target,
+        &DecisionDefinition::Choice {
+            question: "Which action should be taken?".into(),
+            options: vec!["approve".into(), "reject".into()],
+        },
+        &runtime_a,
+        &DecisionOptions::default(),
+        None,
+    )
+    .expect("first");
+    let changed_options = decide_record(
+        &db,
+        &target,
+        &DecisionDefinition::Choice {
+            question: "Which action should be taken?".into(),
+            options: vec!["approve".into(), "reject".into(), "review".into()],
+        },
+        &runtime_a,
+        &DecisionOptions::default(),
+        None,
+    )
+    .expect("changed options");
+    let changed_runtime = decide_record(
+        &db,
+        &target,
+        &DecisionDefinition::Choice {
+            question: "Which action should be taken?".into(),
+            options: vec!["approve".into(), "reject".into()],
+        },
+        &runtime_b,
+        &DecisionOptions::default(),
+        None,
+    )
+    .expect("changed runtime");
+
+    assert_ne!(
+        first.provenance.cache_key,
+        changed_options.provenance.cache_key
+    );
+    assert_ne!(
+        first.provenance.cache_key,
+        changed_runtime.provenance.cache_key
+    );
+}
+
+#[test]
+fn deterministic_runtime_and_file_backed_reopen_reuse_durable_judgments() {
+    let tempdir = TempDir::new().expect("tempdir");
+    let path = tempdir.path().join("decision.log");
+
+    let runtime = {
+        let request = DecisionRequest::Binary {
+            predicate: "could work from home".into(),
+            context: json!({"employmentType":"remote"}),
+        };
+        let mut responses = BTreeMap::new();
+        responses.insert(
+            deterministic_request_key(&request).expect("request key"),
+            DecisionResult::Binary {
+                decision: true,
+                option_mass: 0.9,
+                supporting_fields: vec!["employmentType".into()],
+            },
+        );
+        DeterministicDecisionRuntime::new(
+            DecisionRuntimeMetadata {
+                runtime: "deterministic".into(),
+                model: Some("deterministic-runtime".into()),
+                model_revision: Some("deterministic-v1".into()),
+                prompt_revision: Some("prompt-v1".into()),
+                execution_method: None,
+                decision_schema_revision: None,
+            },
+            responses,
+        )
+    };
+
+    {
+        let db = FeltDb::open(&path).expect("open writer");
+        insert_person(
+            &db,
+            "p-1",
+            json!({"id":"p-1","__version":1,"employmentType":"remote"}),
+        );
+        let first = jev(
+            &db,
+            &DecisionRecordRef {
+                collection: "people".into(),
+                record_id: "p-1".into(),
+            },
+            "could work from home",
+            &runtime,
+            &DecisionOptions {
+                fields: Some(vec!["employmentType".into()]),
+                ..DecisionOptions::default()
+            },
+            None,
+        )
+        .expect("first");
+        assert!(!first.cached);
+    }
+
+    let db = FeltDb::open(&path).expect("open reader");
+    let second = jev(
+        &db,
+        &DecisionRecordRef {
+            collection: "people".into(),
+            record_id: "p-1".into(),
+        },
+        "could work from home",
+        &runtime,
+        &DecisionOptions {
+            fields: Some(vec!["employmentType".into()]),
+            ..DecisionOptions::default()
+        },
+        None,
+    )
+    .expect("second");
+    assert!(second.cached);
+}
+
+#[test]
+fn benchmark_reports_twenty_cases_for_each_primitive_and_reuses_cache() {
+    let db = memory_db("benchmark");
+    struct BenchmarkRuntime(Arc<AtomicUsize>);
+    impl DecisionRuntime for BenchmarkRuntime {
+        fn metadata(&self) -> DecisionRuntimeMetadata {
+            DecisionRuntimeMetadata {
+                runtime: "deterministic".into(),
+                model: Some("benchmark-runtime".into()),
+                model_revision: Some("benchmark-v1".into()),
+                prompt_revision: Some("prompt-v1".into()),
+                execution_method: None,
+                decision_schema_revision: None,
+            }
+        }
+
+        fn decide(&self, request: &DecisionRequest) -> Result<DecisionResult, DecisionError> {
+            self.0.fetch_add(1, Ordering::SeqCst);
+            let context = request.context().as_object().cloned().unwrap_or_default();
+            Ok(match request {
+                DecisionRequest::Binary { .. } => DecisionResult::Binary {
+                    decision: context
+                        .get("employmentType")
+                        .and_then(Value::as_str)
+                        .is_some_and(|value| value == "remote"),
+                    option_mass: 0.75,
+                    supporting_fields: vec!["employmentType".into()],
+                },
+                DecisionRequest::Choice { options, .. } => DecisionResult::Choice {
+                    selected: if context
+                        .get("publicRole")
+                        .and_then(Value::as_str)
+                        .is_some_and(|value| value.contains("Engineer"))
+                    {
+                        "approve".into()
+                    } else {
+                        "review".into()
+                    },
+                    options: options
+                        .iter()
+                        .map(|value| WeightedOption {
+                            value: value.clone(),
+                            probability: if value == "reject" {
+                                0.05
+                            } else if value == "review" {
+                                0.15
+                            } else {
+                                0.8
+                            },
+                        })
+                        .collect(),
+                    option_mass: 0.8,
+                    supporting_fields: vec!["publicRole".into()],
+                },
+                DecisionRequest::Score { levels, .. } => {
+                    let selected = context
+                        .get("urgency")
+                        .and_then(Value::as_str)
+                        .unwrap_or("low")
+                        .to_string();
+                    DecisionResult::Score {
+                        selected: selected.clone(),
+                        levels: levels
+                            .iter()
+                            .map(|value| WeightedOption {
+                                value: value.clone(),
+                                probability: if value == &selected { 0.8 } else { 0.1 },
+                            })
+                            .collect(),
+                        option_mass: 0.8,
+                        supporting_fields: vec!["urgency".into()],
+                    }
+                }
+            })
+        }
+    }
+
+    let counter = Arc::new(AtomicUsize::new(0));
+    let report = run_decision_benchmark(
+        &db,
+        &BenchmarkRuntime(counter.clone()),
+        &DecisionOptions::default(),
+    )
+    .expect("benchmark");
+    assert_eq!(report.binary, 20);
+    assert_eq!(report.choice, 20);
+    assert_eq!(report.score, 20);
+    assert_eq!(report.runtime_invocations_first_pass, 60);
+    assert_eq!(report.runtime_invocations_second_pass, 0);
+    assert_eq!(report.cache_hits_second_pass, 60);
+    assert_eq!(counter.load(Ordering::SeqCst), 60);
+}
+
+#[test]
+fn transport_execution_matches_direct_rust_semantics() {
+    fn seeded(name: &str) -> FeltDb {
+        let db = memory_db(name);
+        insert_person(
+            &db,
+            "p-1",
+            json!({
+                "id":"p-1",
+                "__version":1,
+                "employmentType":"remote",
+                "actionHint":"review",
+                "urgency":"high"
+            }),
+        );
+        db
+    }
+
+    let metadata = DecisionRuntimeMetadata {
+        runtime: "deterministic".into(),
+        model: Some("deterministic-runtime".into()),
+        model_revision: Some("deterministic-v1".into()),
+        prompt_revision: Some("prompt-v1".into()),
+        execution_method: None,
+        decision_schema_revision: None,
+    };
+    let context = json!({
+        "actionHint":"review",
+        "employmentType":"remote",
+        "urgency":"high"
+    });
+    let binary_request = DecisionRequest::Binary {
+        predicate: "could work from home".into(),
+        context: context.clone(),
+    };
+    let choice_request = DecisionRequest::Choice {
+        question: "Which action should be taken?".into(),
+        options: vec!["approve".into(), "reject".into(), "review".into()],
+        context: context.clone(),
+    };
+    let score_request = DecisionRequest::Score {
+        question: "What is the urgency?".into(),
+        levels: vec!["low".into(), "medium".into(), "high".into()],
+        context,
+    };
+    let mut responses = BTreeMap::new();
+    responses.insert(
+        deterministic_request_key(&binary_request).expect("binary key"),
+        DecisionResult::Binary {
+            decision: true,
+            option_mass: 0.9,
+            supporting_fields: vec!["employmentType".into()],
+        },
+    );
+    responses.insert(
+        deterministic_request_key(&choice_request).expect("choice key"),
+        DecisionResult::Choice {
+            selected: "review".into(),
+            options: vec![
+                WeightedOption {
+                    value: "approve".into(),
+                    probability: 0.05,
+                },
+                WeightedOption {
+                    value: "reject".into(),
+                    probability: 0.05,
+                },
+                WeightedOption {
+                    value: "review".into(),
+                    probability: 0.9,
+                },
+            ],
+            option_mass: 0.9,
+            supporting_fields: vec!["actionHint".into()],
+        },
+    );
+    responses.insert(
+        deterministic_request_key(&score_request).expect("score key"),
+        DecisionResult::Score {
+            selected: "high".into(),
+            levels: vec![
+                WeightedOption {
+                    value: "low".into(),
+                    probability: 0.05,
+                },
+                WeightedOption {
+                    value: "medium".into(),
+                    probability: 0.05,
+                },
+                WeightedOption {
+                    value: "high".into(),
+                    probability: 0.9,
+                },
+            ],
+            option_mass: 0.9,
+            supporting_fields: vec!["urgency".into()],
+        },
+    );
+
+    let target = DecisionRecordRef {
+        collection: "people".into(),
+        record_id: "p-1".into(),
+    };
+    let definitions = vec![
+        DecisionDefinition::Binary {
+            predicate: "could work from home".into(),
+        },
+        DecisionDefinition::Choice {
+            question: "Which action should be taken?".into(),
+            options: vec!["approve".into(), "reject".into(), "review".into()],
+        },
+        DecisionDefinition::Score {
+            question: "What is the urgency?".into(),
+            levels: vec!["low".into(), "medium".into(), "high".into()],
+        },
+    ];
+
+    for definition in definitions {
+        let direct_db = seeded("direct-transport");
+        let transport_db = seeded("transport");
+        let direct = decide_record(
+            &direct_db,
+            &target,
+            &definition,
+            &DeterministicDecisionRuntime::new(metadata.clone(), responses.clone()),
+            &DecisionOptions::default(),
+            None,
+        )
+        .expect("direct");
+        let via_transport = execute_decision_transport(
+            &transport_db,
+            &DecisionTransportExecutionRequest {
+                target: Some(target.clone()),
+                context: None,
+                definition: definition.clone(),
+                options: DecisionOptions::default(),
+                authorization: None,
+                runtime: DecisionTransportRuntime::Deterministic {
+                    metadata: metadata.clone(),
+                    responses: responses.clone(),
+                },
+            },
+        )
+        .expect("transport");
+        assert_eq!(
+            via_transport.runtime_requests,
+            Vec::<DecisionRequest>::new()
+        );
+        assert_eq!(via_transport.evaluation.result, direct.result);
+        assert_eq!(via_transport.evaluation.evidence, direct.evidence);
+        assert_eq!(
+            via_transport.evaluation.provenance.context_hash,
+            direct.provenance.context_hash
+        );
+        assert_eq!(
+            via_transport.evaluation.provenance.relevant_state_version,
+            direct.provenance.relevant_state_version
+        );
+        assert_eq!(
+            via_transport.evaluation.provenance.cache_key,
+            direct.provenance.cache_key
+        );
+    }
+}
+
+#[test]
+fn transport_rejects_ambiguous_target_and_inline_context() {
+    let db = memory_db("transport-ambiguous");
+    insert_person(
+        &db,
+        "p-1",
+        json!({"id":"p-1","__version":1,"employmentType":"remote"}),
+    );
+    let error = execute_decision_transport(
+        &db,
+        &DecisionTransportExecutionRequest {
+            target: Some(DecisionRecordRef {
+                collection: "people".into(),
+                record_id: "p-1".into(),
+            }),
+            context: Some(json!({"employmentType":"remote"})),
+            definition: DecisionDefinition::Binary {
+                predicate: "could work from home".into(),
+            },
+            options: DecisionOptions::default(),
+            authorization: None,
+            runtime: DecisionTransportRuntime::Recording {
+                metadata: DecisionRuntimeMetadata {
+                    runtime: "recording".into(),
+                    model: Some("recording-runtime".into()),
+                    model_revision: Some("recording-v1".into()),
+                    prompt_revision: Some("prompt-v1".into()),
+                    execution_method: None,
+                    decision_schema_revision: None,
+                },
+                result: DecisionResult::Binary {
+                    decision: true,
+                    option_mass: 0.9,
+                    supporting_fields: vec!["employmentType".into()],
+                },
+            },
+        },
+    )
+    .expect_err("ambiguous request should fail");
+    assert_eq!(error.code, "DECISION_INVALID_RESULT");
+}
+
+#[test]
+fn transport_authorization_filters_runtime_input_before_execution() {
+    let db = memory_db("transport-auth");
+    let secret = "SENTINEL-secret-field";
+    insert_person(
+        &db,
+        "p-1",
+        json!({
+            "id":"p-1",
+            "__version":1,
+            "public_field":"visible",
+            "secret_field": secret
+        }),
+    );
+    let response = execute_decision_transport(
+        &db,
+        &DecisionTransportExecutionRequest {
+            target: Some(DecisionRecordRef {
+                collection: "people".into(),
+                record_id: "p-1".into(),
+            }),
+            context: None,
+            definition: DecisionDefinition::Binary {
+                predicate: "is visible".into(),
+            },
+            options: DecisionOptions::default(),
+            authorization: Some(DecisionTransportAuthorization {
+                allowed_fields: vec!["public_field".into()],
+                principal: Some(feltdb::DecisionPrincipal {
+                    subject: Subject::Service("reporting-service".into()),
+                    tenant_id: "tenant-a".into(),
+                    application_id: "people-directory".into(),
+                    capability: "state:read".into(),
+                }),
+            }),
+            runtime: DecisionTransportRuntime::Recording {
+                metadata: DecisionRuntimeMetadata {
+                    runtime: "recording".into(),
+                    model: Some("recording-runtime".into()),
+                    model_revision: Some("recording-v1".into()),
+                    prompt_revision: Some("prompt-v1".into()),
+                    execution_method: None,
+                    decision_schema_revision: None,
+                },
+                result: DecisionResult::Binary {
+                    decision: true,
+                    option_mass: 0.8,
+                    supporting_fields: vec!["public_field".into()],
+                },
+            },
+        },
+    )
+    .expect("transport authorization");
+    assert_eq!(response.runtime_requests.len(), 1);
+    let payload = serde_json::to_string(&response.runtime_requests).expect("serialize");
+    assert!(!payload.contains(secret));
+    assert!(!payload.contains("secret_field"));
+    assert!(payload.contains("public_field"));
+    assert_eq!(
+        response.evaluation.evidence[0].state.withheld_fields,
+        vec!["secret_field".to_string()]
+    );
+}
+
+#[test]
+fn decision_batch_shares_authorized_context_without_cross_decision_leakage() {
+    let db = memory_db("decision-batch");
+    insert_person(
+        &db,
+        "p-1",
+        json!({
+            "id":"p-1",
+            "__version":1,
+            "employmentType":"remote",
+            "public_field":"visible"
+        }),
+    );
+    let runtime = RecordingRuntime::new("deterministic-v1", "prompt-v1");
+    let context = authorize_context(
+        "people",
+        "p-1",
+        &json!({
+            "id":"p-1",
+            "__version":1,
+            "employmentType":"remote",
+            "public_field":"visible"
+        }),
+        &DecisionOptions::default(),
+        None,
+    )
+    .expect("context");
+    let evaluations = execute_decision_batch(
+        &context,
+        &DecisionBatch {
+            context: json!({ "shared_fact":"shared" }),
+            decisions: vec![
+                DecisionBatchDecision {
+                    id: "decision-a".into(),
+                    definition: DecisionDefinition::Binary {
+                        predicate: "could work from home".into(),
+                    },
+                    context: json!({ "decision_only":"a" }),
+                },
+                DecisionBatchDecision {
+                    id: "decision-b".into(),
+                    definition: DecisionDefinition::Binary {
+                        predicate: "could work from home".into(),
+                    },
+                    context: json!({}),
+                },
+            ],
+        },
+        &runtime,
+    )
+    .expect("batch");
+    assert_eq!(evaluations.len(), 2);
+    let calls = runtime.calls();
+    assert_eq!(calls.len(), 2);
+    let first = serde_json::to_value(&calls[0]).expect("first");
+    let second = serde_json::to_value(&calls[1]).expect("second");
+    assert_eq!(first["context"]["shared_fact"], "shared");
+    assert_eq!(second["context"]["shared_fact"], "shared");
+    assert_eq!(first["context"]["decision_only"], "a");
+    assert!(second["context"].get("decision_only").is_none());
+}
+
+#[test]
+fn choice_diagnostics_measure_permutations_and_option_expansion() {
+    struct ChoiceRuntime;
+    impl DecisionRuntime for ChoiceRuntime {
+        fn metadata(&self) -> DecisionRuntimeMetadata {
+            DecisionRuntimeMetadata {
+                runtime: "diagnostic".into(),
+                model: Some("diagnostic-runtime".into()),
+                model_revision: Some("diagnostic-v1".into()),
+                prompt_revision: Some("prompt-v1".into()),
+                execution_method: None,
+                decision_schema_revision: None,
+            }
+        }
+
+        fn decide(&self, request: &DecisionRequest) -> Result<DecisionResult, DecisionError> {
+            match request {
+                DecisionRequest::Choice { options, .. } => Ok(DecisionResult::Choice {
+                    selected: options.first().cloned().unwrap_or_default(),
+                    options: options
+                        .iter()
+                        .enumerate()
+                        .map(|(index, value)| WeightedOption {
+                            value: value.clone(),
+                            probability: if index == 0 {
+                                0.6
+                            } else if index == 1 {
+                                0.3
+                            } else {
+                                0.1 / ((options.len() - 2).max(1) as f64)
+                            },
+                        })
+                        .collect(),
+                    option_mass: 0.6,
+                    supporting_fields: vec!["employmentType".into()],
+                }),
+                _ => Err(DecisionError::new(
+                    "DECISION_INVALID_RESULT",
+                    "expected choice request",
+                )),
+            }
+        }
+    }
+
+    let context = authorize_context(
+        "people",
+        "p-1",
+        &json!({
+            "id":"p-1",
+            "__version":1,
+            "employmentType":"remote"
+        }),
+        &DecisionOptions::default(),
+        None,
+    )
+    .expect("context");
+    let report = run_choice_diagnostics(
+        &context,
+        "Which option should be selected?",
+        &["A".into(), "B".into(), "C".into()],
+        Some("D"),
+        &ChoiceRuntime,
+    )
+    .expect("choice diagnostics");
+    assert_eq!(report.permutations.len(), 6);
+    assert!(report
+        .permutations
+        .iter()
+        .any(|entry| entry.order == vec!["A", "B", "C"] && entry.selected == "A"));
+    assert!(report
+        .permutations
+        .iter()
+        .any(|entry| entry.order == vec!["C", "B", "A"] && entry.selected == "C"));
+    let expansion = report.expansion.expect("expansion");
+    assert_eq!(expansion.baseline.order, vec!["A", "B", "C"]);
+    assert_eq!(expansion.expanded.order, vec!["A", "B", "C", "D"]);
+    assert_eq!(expansion.expanded.rank, 1);
+}