kibi-core 0.18.2 → 0.19.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kibi-core",
-  "version": "0.18.2",
+  "version": "0.19.0",
   "private": false,
   "description": "Core Prolog modules and RDF graph logic for Kibi",
   "type": "module",

package/src/kb.pl

@@ -135,6 +135,7 @@ kb_uri('urn-kibi:').
 % the memo never serves a property list the store no longer holds.
 :- dynamic kb_entity_props_memo/2.
 :- dynamic kb_entity_props_memo_key/1.
+:- dynamic kb_decision_signature_memo/2.
 :- dynamic kb_index_verified_key/1.
 :- dynamic entity/4.  % Support legacy .pl file format (Type, Id, Title, Props)
 
@@ -361,6 +362,7 @@ kb_detach :-
             retractall(kb_index_verified_key(_)),
             retractall(kb_entity_props_memo(_, _)),
             retractall(kb_entity_props_memo_key(_)),
+            retractall(kb_decision_signature_memo(_, _)),
             retractall(kb_index_entity(_, _)),
             retractall(kb_index_type(_, _)),
             retractall(kb_index_tag(_, _)),
@@ -2662,6 +2664,154 @@ req_conflict_witness(ReqA, ReqB, Witness) :-
         right: Right
     }.
 
+% implements REQ-kibi-truthful-consistency
+% Opposite decisions on the same case: two asserted facts of a predicate
+% whose key arguments determine a closed allow/deny decision argument (the
+% built-in permission_rule, or a project schema that declares key_arguments
+% and a `decision` argument) agree on every key argument but decide
+% differently, e.g. permission_rule(coach, read, x, allow) against
+% permission_rule(coach, read, x, deny).  kb_model writes a denial as
+% decision deny with polarity deny, so a deny decision counts as a denial
+% whatever its polarity; an allow decision counts only when asserted.
+%
+% Cost: the search answer layer and coverage ask for the witnesses of each
+% requirement with the other side unbound.  The pairing therefore starts
+% from whichever requirement is bound, filters its facts against the
+% decision signatures (memoized per KB generation, so the project schemas
+% are read once rather than once per fact), and pre-binds the partner's key
+% arguments before enumerating partner requirements.
+req_conflict_witness(ReqA, ReqB, Witness) :-
+    decision_signatures(Signatures),
+    Signatures \== [],
+    decision_conflict_pair(Signatures, ReqA, ReqB, FactA, FactB, Namespace, Name,
+                           ArgsA, ArgsB, PolarityA, PolarityB, KeyPositions, DecisionPosition),
+    length(ArgsA, Arity),
+    nth1(DecisionPosition, ArgsA, DecisionA),
+    nth1(DecisionPosition, ArgsB, DecisionB),
+    DecisionA \== DecisionB,
+    effective_decision(DecisionA, PolarityA, EffectA),
+    effective_decision(DecisionB, PolarityB, EffectB),
+    EffectA \== EffectB,
+    findall(KeyValue, (member(Position, KeyPositions), nth1(Position, ArgsA, KeyValue)), KeyValues),
+    atomic_list_concat(KeyValues, ',', KeyText),
+    format(
+        string(Reason),
+        "Decision conflict on ~w:~w(~w): ~w decides ~w while ~w decides ~w",
+        [Namespace, Name, KeyText, ReqA, EffectA, ReqB, EffectB]
+    ),
+    predicate_conflict_side(ReqA, FactA, Namespace, Name, ArgsA, PolarityA, Left),
+    predicate_conflict_side(ReqB, FactB, Namespace, Name, ArgsB, PolarityB, Right),
+    findall(SchemaId, predicate_schema(SchemaId, Namespace, Name, Arity, _Names, _Types), SchemaIds0),
+    sort(SchemaIds0, SchemaIds),
+    Witness = _{
+        kind: predicate,
+        status: contradiction,
+        requirements: [ReqA, ReqB],
+        reason: Reason,
+        predicateNamespace: Namespace,
+        predicateName: Name,
+        predicateArgs: ArgsA,
+        keyArguments: KeyValues,
+        schemaIds: SchemaIds,
+        left: Left,
+        right: Right
+    }.
+
+%% decision_conflict_pair(+Signatures, ?ReqA, ?ReqB, -FactA, -FactB, -Namespace, -Name, -ArgsA, -ArgsB, -PolarityA, -PolarityB, -KeyPositions, -DecisionPosition)
+% Two decision-predicate facts of current requirements ReqA @< ReqB that
+% agree on every key argument.  Starts from the bound requirement.
+decision_conflict_pair(Signatures, ReqA, ReqB, FactA, FactB, Namespace, Name,
+                       ArgsA, ArgsB, PolarityA, PolarityB, KeyPositions, DecisionPosition) :-
+    (   var(ReqA), nonvar(ReqB)
+    ->  decision_req_fact(Signatures, ReqB, FactB, Namespace, Name, ArgsB, PolarityB, KeyPositions, DecisionPosition),
+        length(ArgsB, Arity),
+        length(ArgsA, Arity),
+        bind_key_arguments(KeyPositions, ArgsB, ArgsA),
+        current_req(ReqA),
+        ReqA @< ReqB,
+        effective_req_predicate(ReqA, FactA, Namespace, Name, ArgsA, PolarityA)
+    ;   decision_req_fact(Signatures, ReqA, FactA, Namespace, Name, ArgsA, PolarityA, KeyPositions, DecisionPosition),
+        length(ArgsA, Arity),
+        length(ArgsB, Arity),
+        bind_key_arguments(KeyPositions, ArgsA, ArgsB),
+        current_req(ReqB),
+        ReqA @< ReqB,
+        effective_req_predicate(ReqB, FactB, Namespace, Name, ArgsB, PolarityB)
+    ),
+    FactA \= FactB.
+
+decision_req_fact(Signatures, ReqId, FactId, Namespace, Name, Args, Polarity, KeyPositions, DecisionPosition) :-
+    current_req(ReqId),
+    effective_req_predicate(ReqId, FactId, Namespace, Name, Args, Polarity),
+    length(Args, Arity),
+    memberchk(decision_signature(Namespace, Name, Arity, KeyPositions, DecisionPosition), Signatures).
+
+%% decision_predicate(?Namespace, ?Name, ?Arity, -KeyPositions, -DecisionPosition)
+% A predicate whose key arguments (1-based KeyPositions) determine one
+% allow/deny decision argument.  A project-local predicate_schema decides
+% this for its own signature: it must declare key_arguments and name a
+% non-key argument `decision`.  Without a project schema the built-in
+% catalog entry applies.
+decision_predicate(Namespace, Name, Arity, KeyPositions, DecisionPosition) :-
+    decision_signatures(Signatures),
+    member(decision_signature(Namespace, Name, Arity, KeyPositions, DecisionPosition), Signatures).
+
+%% decision_signatures(-Signatures)
+% All decision predicates of the current KB, memoized per graph, RDF
+% generation and legacy fact count like the entity property memo.
+decision_signatures(Signatures) :-
+    index_verification_key(decision_signatures, Key),
+    (   kb_decision_signature_memo(Key, Cached)
+    ->  Signatures = Cached
+    ;   compute_decision_signatures(Computed),
+        retractall(kb_decision_signature_memo(_, _)),
+        assertz(kb_decision_signature_memo(Key, Computed)),
+        Signatures = Computed
+    ).
+
+compute_decision_signatures(Signatures) :-
+    findall(Namespace-Name-Arity,
+            predicate_schema(_SchemaId, Namespace, Name, Arity, _Names, _Types),
+            SchemaSignatures0),
+    sort(SchemaSignatures0, SchemaSignatures),
+    findall(decision_signature(Namespace, Name, Arity, KeyPositions, DecisionPosition),
+            (   member(Namespace-Name-Arity, SchemaSignatures),
+                schema_decision_positions(Namespace, Name, Arity, KeyPositions, DecisionPosition)
+            ),
+            FromSchemas),
+    findall(decision_signature(Namespace, Name, Arity, KeyPositions, DecisionPosition),
+            (   builtin_decision_predicate(Namespace, Name, Arity, KeyPositions, DecisionPosition),
+                \+ memberchk(Namespace-Name-Arity, SchemaSignatures)
+            ),
+            Builtins),
+    append(FromSchemas, Builtins, Signatures).
+
+schema_decision_positions(Namespace, Name, Arity, KeyPositions, DecisionPosition) :-
+    predicate_schema_keys(Namespace, Name, Arity, KeyPositions),
+    predicate_schema(_SchemaId, Namespace, Name, Arity, ArgumentNames, _ArgumentTypes),
+    nth1(DecisionPosition, ArgumentNames, decision),
+    \+ memberchk(DecisionPosition, KeyPositions),
+    !.
+
+%% bind_key_arguments(+KeyPositions, +ArgsA, ?ArgsB)
+% Unify ArgsB with ArgsA on every key position.
+bind_key_arguments([], _ArgsA, _ArgsB).
+bind_key_arguments([Position|Positions], ArgsA, ArgsB) :-
+    nth1(Position, ArgsA, Value),
+    nth1(Position, ArgsB, Value),
+    bind_key_arguments(Positions, ArgsA, ArgsB).
+
+%% builtin_decision_predicate(?Namespace, ?Name, ?Arity, ?KeyPositions, ?DecisionPosition)
+% Built-in catalog predicates with a closed allow/deny decision.  Keep in
+% step with key_arguments in packages/cli/src/operations/modeling/
+% predicate-catalog-4.ts (permission_rule: actor, action, resource).
+builtin_decision_predicate(default, permission_rule, 4, [1, 2, 3], 4).
+
+%% effective_decision(+Decision, +Polarity, -Effect)
+effective_decision(allow, assert, allow).
+effective_decision(allow, deny, deny).
+effective_decision(deny, _Polarity, deny).
+
 property_conflict_side(ReqId, FactId, SubjectKey, PropertyKey, Operator, ValueType, Value, Unit, Scope, Polarity, ValidFrom, ValidTo, Side) :-
     entity_evidence_source(ReqId, req, RequirementSource),
     fact_evidence_fields(FactId, FactSource, ClaimKey, ClaimText, _CanonicalKey),