eyeprolog 1.6.13 → 1.6.14

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (15) hide show
  1. package/examples/output/takeuchi.pl +1 -1
  2. package/examples/proof/iso-reflective-terms.pl +80 -0
  3. package/examples/proof/iso-term-io.pl +87 -0
  4. package/examples/proof/sbom-vulnerability-response.pl +570 -0
  5. package/examples/proof/takeuchi.pl +1738 -0
  6. package/examples/takeuchi.pl +6 -1
  7. package/package.json +1 -1
  8. package/src/cli.js +1 -1
  9. package/src/explain.js +15 -1
  10. package/src/parser.js +18 -4
  11. package/src/result-format.js +44 -7
  12. package/test/regression/support.mjs +1 -1
  13. package/test/run-proof-checking.mjs +3 -14
  14. package/the-art-of-eyeprolog.md +1 -1
  15. package/why-eyeprolog.md +83 -17
package/examples/proof/sbom-vulnerability-response.pl ADDED
@@ -0,0 +1,570 @@
1
+ deployment_decision(checkout_prod, block).
2
+ exposure_path(checkout_prod, cve_2026_7777, [shop_app, payments_sdk, crypto_wrapper, openssl_3_0_12]).
3
+ required_action(checkout_prod, upgrade(openssl_3_0_12, openssl_3_0_14)).
4
+ waiver_effect(checkout_prod, cve_2026_2222, accepted_until(20261231)).
5
+
6
+ clause(1,
7
+ rdf(iri('https://example.org/supply-chain/service/checkout-prod'), iri('https://example.org/vocab/rootComponent'), iri('https://example.org/supply-chain/component/shop-app'), iri('https://example.org/supply-chain/graph/sbom')),
8
+ true).
9
+ clause(2,
10
+ rdf(iri('https://example.org/supply-chain/component/shop-app'), iri('https://example.org/vocab/dependsOn'), iri('https://example.org/supply-chain/component/payments-sdk'), iri('https://example.org/supply-chain/graph/sbom')),
11
+ true).
12
+ clause(3,
13
+ rdf(iri('https://example.org/supply-chain/component/payments-sdk'), iri('https://example.org/vocab/dependsOn'), iri('https://example.org/supply-chain/component/crypto-wrapper'), iri('https://example.org/supply-chain/graph/sbom')),
14
+ true).
15
+ clause(4,
16
+ rdf(iri('https://example.org/supply-chain/component/crypto-wrapper'), iri('https://example.org/vocab/dependsOn'), iri('https://example.org/supply-chain/component/openssl-3.0.12'), iri('https://example.org/supply-chain/graph/sbom')),
17
+ true).
18
+ clause(7,
19
+ rdf(iri('https://example.org/supply-chain/component/openssl-3.0.12'), iri('https://example.org/vocab/affectedBy'), iri('https://example.org/supply-chain/cve/CVE-2026-7777'), iri('https://example.org/supply-chain/graph/vulnerabilities')),
20
+ true).
21
+ clause(8,
22
+ rdf(iri('https://example.org/supply-chain/cve/CVE-2026-7777'), iri('https://example.org/vocab/severityScore'), literal('98', datatype('http://www.w3.org/2001/XMLSchema#integer')), iri('https://example.org/supply-chain/graph/vulnerabilities')),
23
+ true).
24
+ clause(9,
25
+ rdf(iri('https://example.org/supply-chain/cve/CVE-2026-7777'), iri('https://example.org/vocab/fixedComponent'), iri('https://example.org/supply-chain/component/openssl-3.0.14'), iri('https://example.org/supply-chain/graph/vulnerabilities')),
26
+ true).
27
+ clause(13,
28
+ rdf(iri('https://example.org/supply-chain/service/checkout-prod'), iri('https://example.org/vocab/criticalService'), iri('https://example.org/supply-chain/value/yes'), iri('https://example.org/supply-chain/graph/policy')),
29
+ true).
30
+ clause(14,
31
+ rdf(iri('https://example.org/supply-chain/service/checkout-prod'), iri('https://example.org/vocab/currentDate'), literal('20260828', datatype('http://www.w3.org/2001/XMLSchema#integer')), iri('https://example.org/supply-chain/graph/policy')),
32
+ true).
33
+ clause(15,
34
+ rdf(iri('https://example.org/supply-chain/waiver/logging'), iri('https://example.org/vocab/waivesForService'), iri('https://example.org/supply-chain/service/checkout-prod'), iri('https://example.org/supply-chain/graph/policy')),
35
+ true).
36
+ clause(16,
37
+ rdf(iri('https://example.org/supply-chain/waiver/logging'), iri('https://example.org/vocab/waivesVulnerability'), iri('https://example.org/supply-chain/cve/CVE-2026-2222'), iri('https://example.org/supply-chain/graph/policy')),
38
+ true).
39
+ clause(17,
40
+ rdf(iri('https://example.org/supply-chain/waiver/logging'), iri('https://example.org/vocab/expiresOn'), literal('20261231', datatype('http://www.w3.org/2001/XMLSchema#integer')), iri('https://example.org/supply-chain/graph/policy')),
41
+ true).
42
+ clause(18, v(root_component, iri('https://example.org/vocab/rootComponent')), true).
43
+ clause(19, v(depends_on, iri('https://example.org/vocab/dependsOn')), true).
44
+ clause(20, v(affected_by, iri('https://example.org/vocab/affectedBy')), true).
45
+ clause(21, v(severity_score, iri('https://example.org/vocab/severityScore')), true).
46
+ clause(22, v(fixed_component, iri('https://example.org/vocab/fixedComponent')), true).
47
+ clause(23, v(critical_service, iri('https://example.org/vocab/criticalService')), true).
48
+ clause(24, v(current_date, iri('https://example.org/vocab/currentDate')), true).
49
+ clause(25, v(waives_for_service, iri('https://example.org/vocab/waivesForService')), true).
50
+ clause(26, v(waives_vulnerability, iri('https://example.org/vocab/waivesVulnerability')), true).
51
+ clause(27, v(expires_on, iri('https://example.org/vocab/expiresOn')), true).
52
+ clause(28, g(sbom, iri('https://example.org/supply-chain/graph/sbom')), true).
53
+ clause(29,
54
+ g(vulnerabilities, iri('https://example.org/supply-chain/graph/vulnerabilities')),
55
+ true).
56
+ clause(30, g(policy, iri('https://example.org/supply-chain/graph/policy')), true).
57
+ clause(31,
58
+ resource(checkout_prod, iri('https://example.org/supply-chain/service/checkout-prod')),
59
+ true).
60
+ clause(32, resource(shop_app, iri('https://example.org/supply-chain/component/shop-app')), true).
61
+ clause(33,
62
+ resource(payments_sdk, iri('https://example.org/supply-chain/component/payments-sdk')),
63
+ true).
64
+ clause(34,
65
+ resource(crypto_wrapper, iri('https://example.org/supply-chain/component/crypto-wrapper')),
66
+ true).
67
+ clause(35,
68
+ resource(openssl_3_0_12, iri('https://example.org/supply-chain/component/openssl-3.0.12')),
69
+ true).
70
+ clause(38,
71
+ resource(openssl_3_0_14, iri('https://example.org/supply-chain/component/openssl-3.0.14')),
72
+ true).
73
+ clause(40,
74
+ resource(cve_2026_7777, iri('https://example.org/supply-chain/cve/CVE-2026-7777')),
75
+ true).
76
+ clause(41,
77
+ resource(cve_2026_2222, iri('https://example.org/supply-chain/cve/CVE-2026-2222')),
78
+ true).
79
+ clause(42, yes(iri('https://example.org/supply-chain/value/yes')), true).
80
+ clause(43,
81
+ integer_literal(literal(var('Text'), datatype('http://www.w3.org/2001/XMLSchema#integer')), var('N')),
82
+ (atom_chars(var('Text'), var('Cs')), number_chars(var('N'), var('Cs')))).
83
+ clause(44,
84
+ root_component(var('Service'), var('Root')),
85
+ (resource(var('Service'), var('S')),
86
+ v(root_component, var('P')),
87
+ g(sbom, var('G')),
88
+ rdf(var('S'), var('P'), var('R'), var('G')),
89
+ resource(var('Root'), var('R')))).
90
+ clause(45,
91
+ depends(var('A'), var('B')),
92
+ (resource(var('A'), var('RA')),
93
+ resource(var('B'), var('RB')),
94
+ v(depends_on, var('P')),
95
+ g(sbom, var('G')),
96
+ rdf(var('RA'), var('P'), var('RB'), var('G')))).
97
+ clause(46,
98
+ vulnerability(var('Component'), var('Vuln')),
99
+ (resource(var('Component'), var('C')),
100
+ resource(var('Vuln'), var('V')),
101
+ v(affected_by, var('P')),
102
+ g(vulnerabilities, var('G')),
103
+ rdf(var('C'), var('P'), var('V'), var('G')))).
104
+ clause(47,
105
+ severity(var('Vuln'), var('Score')),
106
+ (resource(var('Vuln'), var('V')),
107
+ v(severity_score, var('P')),
108
+ g(vulnerabilities, var('G')),
109
+ rdf(var('V'), var('P'), var('L'), var('G')),
110
+ integer_literal(var('L'), var('Score')))).
111
+ clause(48,
112
+ fix(var('Vuln'), var('Fixed')),
113
+ (resource(var('Vuln'), var('V')),
114
+ resource(var('Fixed'), var('F')),
115
+ v(fixed_component, var('P')),
116
+ g(vulnerabilities, var('G')),
117
+ rdf(var('V'), var('P'), var('F'), var('G')))).
118
+ clause(49,
119
+ component_path(var('A'), var('B'), var('Path')),
120
+ component_path(var('A'), var('B'), [var('A')], var('Path'))).
121
+ clause(50,
122
+ component_path(var('A'), var('B'), var('Visited'), [var('A'), var('B')]),
123
+ (depends(var('A'), var('B')), \+ member(var('B'), var('Visited')))).
124
+ clause(51,
125
+ component_path(var('A'), var('B'), var('Visited'), [var('A') | var('Rest')]),
126
+ (depends(var('A'), var('C')),
127
+ \+ member(var('C'), var('Visited')),
128
+ component_path(var('C'), var('B'), [var('C') | var('Visited')], var('Rest')))).
129
+ clause(52,
130
+ dependency_path(var('Service'), var('Component'), var('Path')),
131
+ (root_component(var('Service'), var('Root')),
132
+ component_path(var('Root'), var('Component'), var('Path')))).
133
+ clause(53,
134
+ current_date(var('Service'), var('Date')),
135
+ (resource(var('Service'), var('S')),
136
+ v(current_date, var('P')),
137
+ g(policy, var('G')),
138
+ rdf(var('S'), var('P'), var('L'), var('G')),
139
+ integer_literal(var('L'), var('Date')))).
140
+ clause(54,
141
+ critical(var('Service')),
142
+ (resource(var('Service'), var('S')),
143
+ v(critical_service, var('P')),
144
+ g(policy, var('G')),
145
+ yes(var('Y')),
146
+ rdf(var('S'), var('P'), var('Y'), var('G')))).
147
+ clause(55,
148
+ active_waiver(var('Service'), var('Vuln')),
149
+ (resource(var('Service'), var('S')),
150
+ resource(var('Vuln'), var('V')),
151
+ g(policy, var('G')),
152
+ v(waives_for_service, var('PS')),
153
+ v(waives_vulnerability, var('PV')),
154
+ v(expires_on, var('PE')),
155
+ rdf(var('W'), var('PS'), var('S'), var('G')),
156
+ rdf(var('W'), var('PV'), var('V'), var('G')),
157
+ rdf(var('W'), var('PE'), var('L'), var('G')),
158
+ integer_literal(var('L'), var('Expiry')),
159
+ current_date(var('Service'), var('Today')),
160
+ var('Expiry') >= var('Today'))).
161
+ clause(56,
162
+ exposed(var('Service'), var('Vuln'), var('Path'), var('Score')),
163
+ (dependency_path(var('Service'), var('Component'), var('Path')),
164
+ vulnerability(var('Component'), var('Vuln')),
165
+ severity(var('Vuln'), var('Score')),
166
+ \+ active_waiver(var('Service'), var('Vuln')))).
167
+ clause(57,
168
+ blocking_exposure(var('Service'), var('Vuln'), var('Path'), var('Score')),
169
+ (exposed(var('Service'), var('Vuln'), var('Path'), var('Score')), var('Score') >= 70)).
170
+ clause(58,
171
+ deployment_decision(var('Service'), block),
172
+ (critical(var('Service')),
173
+ blocking_exposure(var('Service'), anonymous(1), anonymous(2), anonymous(3)))).
174
+ clause(59,
175
+ exposure_path(var('Service'), var('Vuln'), var('Path')),
176
+ blocking_exposure(var('Service'), var('Vuln'), var('Path'), anonymous(1))).
177
+ clause(60,
178
+ required_action(var('Service'), upgrade(var('Component'), var('Fixed'))),
179
+ (blocking_exposure(var('Service'), var('Vuln'), var('Path'), anonymous(1)),
180
+ last(var('Path'), var('Component')),
181
+ fix(var('Vuln'), var('Fixed')))).
182
+ clause(61,
183
+ waiver_effect(var('Service'), var('Vuln'), accepted_until(var('Expiry'))),
184
+ (active_waiver(var('Service'), var('Vuln')),
185
+ resource(var('Service'), var('S')),
186
+ resource(var('Vuln'), var('V')),
187
+ g(policy, var('G')),
188
+ v(waives_for_service, var('PS')),
189
+ v(waives_vulnerability, var('PV')),
190
+ v(expires_on, var('PE')),
191
+ rdf(var('W'), var('PS'), var('S'), var('G')),
192
+ rdf(var('W'), var('PV'), var('V'), var('G')),
193
+ rdf(var('W'), var('PE'), var('L'), var('G')),
194
+ integer_literal(var('L'), var('Expiry')))).
195
+
196
+ step(deployment_decision(checkout_prod, block),
197
+ rule(58),
198
+ ['Service' = checkout_prod],
199
+ [critical(checkout_prod),
200
+ blocking_exposure(checkout_prod, cve_2026_7777, [shop_app, payments_sdk, crypto_wrapper, openssl_3_0_12], 98)]).
201
+ step(critical(checkout_prod),
202
+ rule(54),
203
+ ['Service' = checkout_prod,
204
+ 'S' = iri('https://example.org/supply-chain/service/checkout-prod'),
205
+ 'P' = iri('https://example.org/vocab/criticalService'),
206
+ 'G' = iri('https://example.org/supply-chain/graph/policy'),
207
+ 'Y' = iri('https://example.org/supply-chain/value/yes')],
208
+ [resource(checkout_prod, iri('https://example.org/supply-chain/service/checkout-prod')),
209
+ v(critical_service, iri('https://example.org/vocab/criticalService')),
210
+ g(policy, iri('https://example.org/supply-chain/graph/policy')),
211
+ yes(iri('https://example.org/supply-chain/value/yes')),
212
+ rdf(iri('https://example.org/supply-chain/service/checkout-prod'), iri('https://example.org/vocab/criticalService'), iri('https://example.org/supply-chain/value/yes'), iri('https://example.org/supply-chain/graph/policy'))]).
213
+ step(resource(checkout_prod, iri('https://example.org/supply-chain/service/checkout-prod')),
214
+ fact(31),
215
+ [],
216
+ []).
217
+ step(v(critical_service, iri('https://example.org/vocab/criticalService')), fact(23), [], []).
218
+ step(g(policy, iri('https://example.org/supply-chain/graph/policy')), fact(30), [], []).
219
+ step(yes(iri('https://example.org/supply-chain/value/yes')), fact(42), [], []).
220
+ step(rdf(iri('https://example.org/supply-chain/service/checkout-prod'), iri('https://example.org/vocab/criticalService'), iri('https://example.org/supply-chain/value/yes'), iri('https://example.org/supply-chain/graph/policy')),
221
+ fact(13),
222
+ [],
223
+ []).
224
+ step(blocking_exposure(checkout_prod, cve_2026_7777, [shop_app, payments_sdk, crypto_wrapper, openssl_3_0_12], 98),
225
+ rule(57),
226
+ ['Service' = checkout_prod,
227
+ 'Vuln' = cve_2026_7777,
228
+ 'Path' = [shop_app, payments_sdk, crypto_wrapper, openssl_3_0_12],
229
+ 'Score' = 98],
230
+ [exposed(checkout_prod, cve_2026_7777, [shop_app, payments_sdk, crypto_wrapper, openssl_3_0_12], 98),
231
+ 98 >= 70]).
232
+ step(exposed(checkout_prod, cve_2026_7777, [shop_app, payments_sdk, crypto_wrapper, openssl_3_0_12], 98),
233
+ rule(56),
234
+ ['Service' = checkout_prod,
235
+ 'Vuln' = cve_2026_7777,
236
+ 'Path' = [shop_app, payments_sdk, crypto_wrapper, openssl_3_0_12],
237
+ 'Score' = 98,
238
+ 'Component' = openssl_3_0_12],
239
+ [dependency_path(checkout_prod, openssl_3_0_12, [shop_app, payments_sdk, crypto_wrapper, openssl_3_0_12]),
240
+ vulnerability(openssl_3_0_12, cve_2026_7777),
241
+ severity(cve_2026_7777, 98),
242
+ \+ active_waiver(checkout_prod, cve_2026_7777)]).
243
+ step(dependency_path(checkout_prod, openssl_3_0_12, [shop_app, payments_sdk, crypto_wrapper, openssl_3_0_12]),
244
+ rule(52),
245
+ ['Service' = checkout_prod,
246
+ 'Component' = openssl_3_0_12,
247
+ 'Path' = [shop_app, payments_sdk, crypto_wrapper, openssl_3_0_12],
248
+ 'Root' = shop_app],
249
+ [root_component(checkout_prod, shop_app),
250
+ component_path(shop_app, openssl_3_0_12, [shop_app, payments_sdk, crypto_wrapper, openssl_3_0_12])]).
251
+ step(root_component(checkout_prod, shop_app),
252
+ rule(44),
253
+ ['Service' = checkout_prod,
254
+ 'Root' = shop_app,
255
+ 'S' = iri('https://example.org/supply-chain/service/checkout-prod'),
256
+ 'P' = iri('https://example.org/vocab/rootComponent'),
257
+ 'G' = iri('https://example.org/supply-chain/graph/sbom'),
258
+ 'R' = iri('https://example.org/supply-chain/component/shop-app')],
259
+ [resource(checkout_prod, iri('https://example.org/supply-chain/service/checkout-prod')),
260
+ v(root_component, iri('https://example.org/vocab/rootComponent')),
261
+ g(sbom, iri('https://example.org/supply-chain/graph/sbom')),
262
+ rdf(iri('https://example.org/supply-chain/service/checkout-prod'), iri('https://example.org/vocab/rootComponent'), iri('https://example.org/supply-chain/component/shop-app'), iri('https://example.org/supply-chain/graph/sbom')),
263
+ resource(shop_app, iri('https://example.org/supply-chain/component/shop-app'))]).
264
+ step(v(root_component, iri('https://example.org/vocab/rootComponent')), fact(18), [], []).
265
+ step(g(sbom, iri('https://example.org/supply-chain/graph/sbom')), fact(28), [], []).
266
+ step(rdf(iri('https://example.org/supply-chain/service/checkout-prod'), iri('https://example.org/vocab/rootComponent'), iri('https://example.org/supply-chain/component/shop-app'), iri('https://example.org/supply-chain/graph/sbom')),
267
+ fact(1),
268
+ [],
269
+ []).
270
+ step(resource(shop_app, iri('https://example.org/supply-chain/component/shop-app')),
271
+ fact(32),
272
+ [],
273
+ []).
274
+ step(component_path(shop_app, openssl_3_0_12, [shop_app, payments_sdk, crypto_wrapper, openssl_3_0_12]),
275
+ rule(49),
276
+ ['A' = shop_app,
277
+ 'B' = openssl_3_0_12,
278
+ 'Path' = [shop_app, payments_sdk, crypto_wrapper, openssl_3_0_12]],
279
+ [component_path(shop_app, openssl_3_0_12, [shop_app], [shop_app, payments_sdk, crypto_wrapper, openssl_3_0_12])]).
280
+ step(component_path(shop_app, openssl_3_0_12, [shop_app], [shop_app, payments_sdk, crypto_wrapper, openssl_3_0_12]),
281
+ rule(51),
282
+ ['A' = shop_app,
283
+ 'B' = openssl_3_0_12,
284
+ 'Visited' = [shop_app],
285
+ 'Rest' = [payments_sdk, crypto_wrapper, openssl_3_0_12],
286
+ 'C' = payments_sdk],
287
+ [depends(shop_app, payments_sdk),
288
+ \+ member(payments_sdk, [shop_app]),
289
+ component_path(payments_sdk, openssl_3_0_12, [payments_sdk, shop_app], [payments_sdk, crypto_wrapper, openssl_3_0_12])]).
290
+ step(depends(shop_app, payments_sdk),
291
+ rule(45),
292
+ ['A' = shop_app,
293
+ 'B' = payments_sdk,
294
+ 'RA' = iri('https://example.org/supply-chain/component/shop-app'),
295
+ 'RB' = iri('https://example.org/supply-chain/component/payments-sdk'),
296
+ 'P' = iri('https://example.org/vocab/dependsOn'),
297
+ 'G' = iri('https://example.org/supply-chain/graph/sbom')],
298
+ [resource(shop_app, iri('https://example.org/supply-chain/component/shop-app')),
299
+ resource(payments_sdk, iri('https://example.org/supply-chain/component/payments-sdk')),
300
+ v(depends_on, iri('https://example.org/vocab/dependsOn')),
301
+ g(sbom, iri('https://example.org/supply-chain/graph/sbom')),
302
+ rdf(iri('https://example.org/supply-chain/component/shop-app'), iri('https://example.org/vocab/dependsOn'), iri('https://example.org/supply-chain/component/payments-sdk'), iri('https://example.org/supply-chain/graph/sbom'))]).
303
+ step(resource(payments_sdk, iri('https://example.org/supply-chain/component/payments-sdk')),
304
+ fact(33),
305
+ [],
306
+ []).
307
+ step(v(depends_on, iri('https://example.org/vocab/dependsOn')), fact(19), [], []).
308
+ step(rdf(iri('https://example.org/supply-chain/component/shop-app'), iri('https://example.org/vocab/dependsOn'), iri('https://example.org/supply-chain/component/payments-sdk'), iri('https://example.org/supply-chain/graph/sbom')),
309
+ fact(2),
310
+ [],
311
+ []).
312
+ step(\+ member(payments_sdk, [shop_app]), absent, [], []).
313
+ step(component_path(payments_sdk, openssl_3_0_12, [payments_sdk, shop_app], [payments_sdk, crypto_wrapper, openssl_3_0_12]),
314
+ rule(51),
315
+ ['A' = payments_sdk,
316
+ 'B' = openssl_3_0_12,
317
+ 'Visited' = [payments_sdk, shop_app],
318
+ 'Rest' = [crypto_wrapper, openssl_3_0_12],
319
+ 'C' = crypto_wrapper],
320
+ [depends(payments_sdk, crypto_wrapper),
321
+ \+ member(crypto_wrapper, [payments_sdk, shop_app]),
322
+ component_path(crypto_wrapper, openssl_3_0_12, [crypto_wrapper, payments_sdk, shop_app], [crypto_wrapper, openssl_3_0_12])]).
323
+ step(depends(payments_sdk, crypto_wrapper),
324
+ rule(45),
325
+ ['A' = payments_sdk,
326
+ 'B' = crypto_wrapper,
327
+ 'RA' = iri('https://example.org/supply-chain/component/payments-sdk'),
328
+ 'RB' = iri('https://example.org/supply-chain/component/crypto-wrapper'),
329
+ 'P' = iri('https://example.org/vocab/dependsOn'),
330
+ 'G' = iri('https://example.org/supply-chain/graph/sbom')],
331
+ [resource(payments_sdk, iri('https://example.org/supply-chain/component/payments-sdk')),
332
+ resource(crypto_wrapper, iri('https://example.org/supply-chain/component/crypto-wrapper')),
333
+ v(depends_on, iri('https://example.org/vocab/dependsOn')),
334
+ g(sbom, iri('https://example.org/supply-chain/graph/sbom')),
335
+ rdf(iri('https://example.org/supply-chain/component/payments-sdk'), iri('https://example.org/vocab/dependsOn'), iri('https://example.org/supply-chain/component/crypto-wrapper'), iri('https://example.org/supply-chain/graph/sbom'))]).
336
+ step(resource(crypto_wrapper, iri('https://example.org/supply-chain/component/crypto-wrapper')),
337
+ fact(34),
338
+ [],
339
+ []).
340
+ step(rdf(iri('https://example.org/supply-chain/component/payments-sdk'), iri('https://example.org/vocab/dependsOn'), iri('https://example.org/supply-chain/component/crypto-wrapper'), iri('https://example.org/supply-chain/graph/sbom')),
341
+ fact(3),
342
+ [],
343
+ []).
344
+ step(\+ member(crypto_wrapper, [payments_sdk, shop_app]), absent, [], []).
345
+ step(component_path(crypto_wrapper, openssl_3_0_12, [crypto_wrapper, payments_sdk, shop_app], [crypto_wrapper, openssl_3_0_12]),
346
+ rule(50),
347
+ ['A' = crypto_wrapper,
348
+ 'B' = openssl_3_0_12,
349
+ 'Visited' = [crypto_wrapper, payments_sdk, shop_app]],
350
+ [depends(crypto_wrapper, openssl_3_0_12),
351
+ \+ member(openssl_3_0_12, [crypto_wrapper, payments_sdk, shop_app])]).
352
+ step(depends(crypto_wrapper, openssl_3_0_12),
353
+ rule(45),
354
+ ['A' = crypto_wrapper,
355
+ 'B' = openssl_3_0_12,
356
+ 'RA' = iri('https://example.org/supply-chain/component/crypto-wrapper'),
357
+ 'RB' = iri('https://example.org/supply-chain/component/openssl-3.0.12'),
358
+ 'P' = iri('https://example.org/vocab/dependsOn'),
359
+ 'G' = iri('https://example.org/supply-chain/graph/sbom')],
360
+ [resource(crypto_wrapper, iri('https://example.org/supply-chain/component/crypto-wrapper')),
361
+ resource(openssl_3_0_12, iri('https://example.org/supply-chain/component/openssl-3.0.12')),
362
+ v(depends_on, iri('https://example.org/vocab/dependsOn')),
363
+ g(sbom, iri('https://example.org/supply-chain/graph/sbom')),
364
+ rdf(iri('https://example.org/supply-chain/component/crypto-wrapper'), iri('https://example.org/vocab/dependsOn'), iri('https://example.org/supply-chain/component/openssl-3.0.12'), iri('https://example.org/supply-chain/graph/sbom'))]).
365
+ step(resource(openssl_3_0_12, iri('https://example.org/supply-chain/component/openssl-3.0.12')),
366
+ fact(35),
367
+ [],
368
+ []).
369
+ step(rdf(iri('https://example.org/supply-chain/component/crypto-wrapper'), iri('https://example.org/vocab/dependsOn'), iri('https://example.org/supply-chain/component/openssl-3.0.12'), iri('https://example.org/supply-chain/graph/sbom')),
370
+ fact(4),
371
+ [],
372
+ []).
373
+ step(\+ member(openssl_3_0_12, [crypto_wrapper, payments_sdk, shop_app]), absent, [], []).
374
+ step(vulnerability(openssl_3_0_12, cve_2026_7777),
375
+ rule(46),
376
+ ['Component' = openssl_3_0_12,
377
+ 'Vuln' = cve_2026_7777,
378
+ 'C' = iri('https://example.org/supply-chain/component/openssl-3.0.12'),
379
+ 'V' = iri('https://example.org/supply-chain/cve/CVE-2026-7777'),
380
+ 'P' = iri('https://example.org/vocab/affectedBy'),
381
+ 'G' = iri('https://example.org/supply-chain/graph/vulnerabilities')],
382
+ [resource(openssl_3_0_12, iri('https://example.org/supply-chain/component/openssl-3.0.12')),
383
+ resource(cve_2026_7777, iri('https://example.org/supply-chain/cve/CVE-2026-7777')),
384
+ v(affected_by, iri('https://example.org/vocab/affectedBy')),
385
+ g(vulnerabilities, iri('https://example.org/supply-chain/graph/vulnerabilities')),
386
+ rdf(iri('https://example.org/supply-chain/component/openssl-3.0.12'), iri('https://example.org/vocab/affectedBy'), iri('https://example.org/supply-chain/cve/CVE-2026-7777'), iri('https://example.org/supply-chain/graph/vulnerabilities'))]).
387
+ step(resource(cve_2026_7777, iri('https://example.org/supply-chain/cve/CVE-2026-7777')),
388
+ fact(40),
389
+ [],
390
+ []).
391
+ step(v(affected_by, iri('https://example.org/vocab/affectedBy')), fact(20), [], []).
392
+ step(g(vulnerabilities, iri('https://example.org/supply-chain/graph/vulnerabilities')),
393
+ fact(29),
394
+ [],
395
+ []).
396
+ step(rdf(iri('https://example.org/supply-chain/component/openssl-3.0.12'), iri('https://example.org/vocab/affectedBy'), iri('https://example.org/supply-chain/cve/CVE-2026-7777'), iri('https://example.org/supply-chain/graph/vulnerabilities')),
397
+ fact(7),
398
+ [],
399
+ []).
400
+ step(severity(cve_2026_7777, 98),
401
+ rule(47),
402
+ ['Vuln' = cve_2026_7777,
403
+ 'Score' = 98,
404
+ 'V' = iri('https://example.org/supply-chain/cve/CVE-2026-7777'),
405
+ 'P' = iri('https://example.org/vocab/severityScore'),
406
+ 'G' = iri('https://example.org/supply-chain/graph/vulnerabilities'),
407
+ 'L' = literal('98', datatype('http://www.w3.org/2001/XMLSchema#integer'))],
408
+ [resource(cve_2026_7777, iri('https://example.org/supply-chain/cve/CVE-2026-7777')),
409
+ v(severity_score, iri('https://example.org/vocab/severityScore')),
410
+ g(vulnerabilities, iri('https://example.org/supply-chain/graph/vulnerabilities')),
411
+ rdf(iri('https://example.org/supply-chain/cve/CVE-2026-7777'), iri('https://example.org/vocab/severityScore'), literal('98', datatype('http://www.w3.org/2001/XMLSchema#integer')), iri('https://example.org/supply-chain/graph/vulnerabilities')),
412
+ integer_literal(literal('98', datatype('http://www.w3.org/2001/XMLSchema#integer')), 98)]).
413
+ step(v(severity_score, iri('https://example.org/vocab/severityScore')), fact(21), [], []).
414
+ step(rdf(iri('https://example.org/supply-chain/cve/CVE-2026-7777'), iri('https://example.org/vocab/severityScore'), literal('98', datatype('http://www.w3.org/2001/XMLSchema#integer')), iri('https://example.org/supply-chain/graph/vulnerabilities')),
415
+ fact(8),
416
+ [],
417
+ []).
418
+ step(integer_literal(literal('98', datatype('http://www.w3.org/2001/XMLSchema#integer')), 98),
419
+ rule(43),
420
+ ['Text' = '98', 'N' = 98, 'Cs' = "98"],
421
+ [atom_chars('98', "98"), number_chars(98, "98")]).
422
+ step(atom_chars('98', "98"), builtin, [], []).
423
+ step(number_chars(98, "98"), builtin, [], []).
424
+ step(\+ active_waiver(checkout_prod, cve_2026_7777), absent, [], []).
425
+ step(98 >= 70, builtin, [], []).
426
+ step(exposure_path(checkout_prod, cve_2026_7777, [shop_app, payments_sdk, crypto_wrapper, openssl_3_0_12]),
427
+ rule(59),
428
+ ['Service' = checkout_prod,
429
+ 'Vuln' = cve_2026_7777,
430
+ 'Path' = [shop_app, payments_sdk, crypto_wrapper, openssl_3_0_12]],
431
+ [blocking_exposure(checkout_prod, cve_2026_7777, [shop_app, payments_sdk, crypto_wrapper, openssl_3_0_12], 98)]).
432
+ step(required_action(checkout_prod, upgrade(openssl_3_0_12, openssl_3_0_14)),
433
+ rule(60),
434
+ ['Service' = checkout_prod,
435
+ 'Component' = openssl_3_0_12,
436
+ 'Fixed' = openssl_3_0_14,
437
+ 'Vuln' = cve_2026_7777,
438
+ 'Path' = [shop_app, payments_sdk, crypto_wrapper, openssl_3_0_12]],
439
+ [blocking_exposure(checkout_prod, cve_2026_7777, [shop_app, payments_sdk, crypto_wrapper, openssl_3_0_12], 98),
440
+ last([shop_app, payments_sdk, crypto_wrapper, openssl_3_0_12], openssl_3_0_12),
441
+ fix(cve_2026_7777, openssl_3_0_14)]).
442
+ step(last([shop_app, payments_sdk, crypto_wrapper, openssl_3_0_12], openssl_3_0_12),
443
+ builtin,
444
+ [],
445
+ []).
446
+ step(fix(cve_2026_7777, openssl_3_0_14),
447
+ rule(48),
448
+ ['Vuln' = cve_2026_7777,
449
+ 'Fixed' = openssl_3_0_14,
450
+ 'V' = iri('https://example.org/supply-chain/cve/CVE-2026-7777'),
451
+ 'F' = iri('https://example.org/supply-chain/component/openssl-3.0.14'),
452
+ 'P' = iri('https://example.org/vocab/fixedComponent'),
453
+ 'G' = iri('https://example.org/supply-chain/graph/vulnerabilities')],
454
+ [resource(cve_2026_7777, iri('https://example.org/supply-chain/cve/CVE-2026-7777')),
455
+ resource(openssl_3_0_14, iri('https://example.org/supply-chain/component/openssl-3.0.14')),
456
+ v(fixed_component, iri('https://example.org/vocab/fixedComponent')),
457
+ g(vulnerabilities, iri('https://example.org/supply-chain/graph/vulnerabilities')),
458
+ rdf(iri('https://example.org/supply-chain/cve/CVE-2026-7777'), iri('https://example.org/vocab/fixedComponent'), iri('https://example.org/supply-chain/component/openssl-3.0.14'), iri('https://example.org/supply-chain/graph/vulnerabilities'))]).
459
+ step(resource(openssl_3_0_14, iri('https://example.org/supply-chain/component/openssl-3.0.14')),
460
+ fact(38),
461
+ [],
462
+ []).
463
+ step(v(fixed_component, iri('https://example.org/vocab/fixedComponent')), fact(22), [], []).
464
+ step(rdf(iri('https://example.org/supply-chain/cve/CVE-2026-7777'), iri('https://example.org/vocab/fixedComponent'), iri('https://example.org/supply-chain/component/openssl-3.0.14'), iri('https://example.org/supply-chain/graph/vulnerabilities')),
465
+ fact(9),
466
+ [],
467
+ []).
468
+ step(waiver_effect(checkout_prod, cve_2026_2222, accepted_until(20261231)),
469
+ rule(61),
470
+ ['Service' = checkout_prod,
471
+ 'Vuln' = cve_2026_2222,
472
+ 'Expiry' = 20261231,
473
+ 'S' = iri('https://example.org/supply-chain/service/checkout-prod'),
474
+ 'V' = iri('https://example.org/supply-chain/cve/CVE-2026-2222'),
475
+ 'G' = iri('https://example.org/supply-chain/graph/policy'),
476
+ 'PS' = iri('https://example.org/vocab/waivesForService'),
477
+ 'PV' = iri('https://example.org/vocab/waivesVulnerability'),
478
+ 'PE' = iri('https://example.org/vocab/expiresOn'),
479
+ 'W' = iri('https://example.org/supply-chain/waiver/logging'),
480
+ 'L' = literal('20261231', datatype('http://www.w3.org/2001/XMLSchema#integer'))],
481
+ [active_waiver(checkout_prod, cve_2026_2222),
482
+ resource(checkout_prod, iri('https://example.org/supply-chain/service/checkout-prod')),
483
+ resource(cve_2026_2222, iri('https://example.org/supply-chain/cve/CVE-2026-2222')),
484
+ g(policy, iri('https://example.org/supply-chain/graph/policy')),
485
+ v(waives_for_service, iri('https://example.org/vocab/waivesForService')),
486
+ v(waives_vulnerability, iri('https://example.org/vocab/waivesVulnerability')),
487
+ v(expires_on, iri('https://example.org/vocab/expiresOn')),
488
+ rdf(iri('https://example.org/supply-chain/waiver/logging'), iri('https://example.org/vocab/waivesForService'), iri('https://example.org/supply-chain/service/checkout-prod'), iri('https://example.org/supply-chain/graph/policy')),
489
+ rdf(iri('https://example.org/supply-chain/waiver/logging'), iri('https://example.org/vocab/waivesVulnerability'), iri('https://example.org/supply-chain/cve/CVE-2026-2222'), iri('https://example.org/supply-chain/graph/policy')),
490
+ rdf(iri('https://example.org/supply-chain/waiver/logging'), iri('https://example.org/vocab/expiresOn'), literal('20261231', datatype('http://www.w3.org/2001/XMLSchema#integer')), iri('https://example.org/supply-chain/graph/policy')),
491
+ integer_literal(literal('20261231', datatype('http://www.w3.org/2001/XMLSchema#integer')), 20261231)]).
492
+ step(active_waiver(checkout_prod, cve_2026_2222),
493
+ rule(55),
494
+ ['Service' = checkout_prod,
495
+ 'Vuln' = cve_2026_2222,
496
+ 'S' = iri('https://example.org/supply-chain/service/checkout-prod'),
497
+ 'V' = iri('https://example.org/supply-chain/cve/CVE-2026-2222'),
498
+ 'G' = iri('https://example.org/supply-chain/graph/policy'),
499
+ 'PS' = iri('https://example.org/vocab/waivesForService'),
500
+ 'PV' = iri('https://example.org/vocab/waivesVulnerability'),
501
+ 'PE' = iri('https://example.org/vocab/expiresOn'),
502
+ 'W' = iri('https://example.org/supply-chain/waiver/logging'),
503
+ 'L' = literal('20261231', datatype('http://www.w3.org/2001/XMLSchema#integer')),
504
+ 'Expiry' = 20261231,
505
+ 'Today' = 20260828],
506
+ [resource(checkout_prod, iri('https://example.org/supply-chain/service/checkout-prod')),
507
+ resource(cve_2026_2222, iri('https://example.org/supply-chain/cve/CVE-2026-2222')),
508
+ g(policy, iri('https://example.org/supply-chain/graph/policy')),
509
+ v(waives_for_service, iri('https://example.org/vocab/waivesForService')),
510
+ v(waives_vulnerability, iri('https://example.org/vocab/waivesVulnerability')),
511
+ v(expires_on, iri('https://example.org/vocab/expiresOn')),
512
+ rdf(iri('https://example.org/supply-chain/waiver/logging'), iri('https://example.org/vocab/waivesForService'), iri('https://example.org/supply-chain/service/checkout-prod'), iri('https://example.org/supply-chain/graph/policy')),
513
+ rdf(iri('https://example.org/supply-chain/waiver/logging'), iri('https://example.org/vocab/waivesVulnerability'), iri('https://example.org/supply-chain/cve/CVE-2026-2222'), iri('https://example.org/supply-chain/graph/policy')),
514
+ rdf(iri('https://example.org/supply-chain/waiver/logging'), iri('https://example.org/vocab/expiresOn'), literal('20261231', datatype('http://www.w3.org/2001/XMLSchema#integer')), iri('https://example.org/supply-chain/graph/policy')),
515
+ integer_literal(literal('20261231', datatype('http://www.w3.org/2001/XMLSchema#integer')), 20261231),
516
+ current_date(checkout_prod, 20260828),
517
+ 20261231 >= 20260828]).
518
+ step(resource(cve_2026_2222, iri('https://example.org/supply-chain/cve/CVE-2026-2222')),
519
+ fact(41),
520
+ [],
521
+ []).
522
+ step(v(waives_for_service, iri('https://example.org/vocab/waivesForService')), fact(25), [], []).
523
+ step(v(waives_vulnerability, iri('https://example.org/vocab/waivesVulnerability')),
524
+ fact(26),
525
+ [],
526
+ []).
527
+ step(v(expires_on, iri('https://example.org/vocab/expiresOn')), fact(27), [], []).
528
+ step(rdf(iri('https://example.org/supply-chain/waiver/logging'), iri('https://example.org/vocab/waivesForService'), iri('https://example.org/supply-chain/service/checkout-prod'), iri('https://example.org/supply-chain/graph/policy')),
529
+ fact(15),
530
+ [],
531
+ []).
532
+ step(rdf(iri('https://example.org/supply-chain/waiver/logging'), iri('https://example.org/vocab/waivesVulnerability'), iri('https://example.org/supply-chain/cve/CVE-2026-2222'), iri('https://example.org/supply-chain/graph/policy')),
533
+ fact(16),
534
+ [],
535
+ []).
536
+ step(rdf(iri('https://example.org/supply-chain/waiver/logging'), iri('https://example.org/vocab/expiresOn'), literal('20261231', datatype('http://www.w3.org/2001/XMLSchema#integer')), iri('https://example.org/supply-chain/graph/policy')),
537
+ fact(17),
538
+ [],
539
+ []).
540
+ step(integer_literal(literal('20261231', datatype('http://www.w3.org/2001/XMLSchema#integer')), 20261231),
541
+ rule(43),
542
+ ['Text' = '20261231', 'N' = 20261231, 'Cs' = "20261231"],
543
+ [atom_chars('20261231', "20261231"), number_chars(20261231, "20261231")]).
544
+ step(atom_chars('20261231', "20261231"), builtin, [], []).
545
+ step(number_chars(20261231, "20261231"), builtin, [], []).
546
+ step(current_date(checkout_prod, 20260828),
547
+ rule(53),
548
+ ['Service' = checkout_prod,
549
+ 'Date' = 20260828,
550
+ 'S' = iri('https://example.org/supply-chain/service/checkout-prod'),
551
+ 'P' = iri('https://example.org/vocab/currentDate'),
552
+ 'G' = iri('https://example.org/supply-chain/graph/policy'),
553
+ 'L' = literal('20260828', datatype('http://www.w3.org/2001/XMLSchema#integer'))],
554
+ [resource(checkout_prod, iri('https://example.org/supply-chain/service/checkout-prod')),
555
+ v(current_date, iri('https://example.org/vocab/currentDate')),
556
+ g(policy, iri('https://example.org/supply-chain/graph/policy')),
557
+ rdf(iri('https://example.org/supply-chain/service/checkout-prod'), iri('https://example.org/vocab/currentDate'), literal('20260828', datatype('http://www.w3.org/2001/XMLSchema#integer')), iri('https://example.org/supply-chain/graph/policy')),
558
+ integer_literal(literal('20260828', datatype('http://www.w3.org/2001/XMLSchema#integer')), 20260828)]).
559
+ step(v(current_date, iri('https://example.org/vocab/currentDate')), fact(24), [], []).
560
+ step(rdf(iri('https://example.org/supply-chain/service/checkout-prod'), iri('https://example.org/vocab/currentDate'), literal('20260828', datatype('http://www.w3.org/2001/XMLSchema#integer')), iri('https://example.org/supply-chain/graph/policy')),
561
+ fact(14),
562
+ [],
563
+ []).
564
+ step(integer_literal(literal('20260828', datatype('http://www.w3.org/2001/XMLSchema#integer')), 20260828),
565
+ rule(43),
566
+ ['Text' = '20260828', 'N' = 20260828, 'Cs' = "20260828"],
567
+ [atom_chars('20260828', "20260828"), number_chars(20260828, "20260828")]).
568
+ step(atom_chars('20260828', "20260828"), builtin, [], []).
569
+ step(number_chars(20260828, "20260828"), builtin, [], []).
570
+ step(20261231 >= 20260828, builtin, [], []).