capsule-engine 0.1.0__py3-none-any.whl

capsule_engine/guards/checks/release_on_acceptance.py

@@ -0,0 +1,286 @@
+# SPDX-License-Identifier: Apache-2.0
+"""release_on_acceptance check: personal data is released only to the buyer
+who accepted.
+
+A seller negotiates one sale with several buyers, one thread each. Personal
+data may reach a buyer only once that buyer's acceptance is sealed. The
+wicket's ``binding`` selects how a disclosure is bound to it.
+
+**Cited** (no ``binding``: seller.release_on_acceptance/1.0.0 and 1.1.0).
+``release_classes`` is the closed set of classes a disclosure may declare;
+a disclosure in ``action_classes`` whose ``representation_class`` is in it
+passes only when ALL hold:
+
+- it names its sale (``task_authority_ref`` and ``item_ref``) and its
+  recipient (``target``);
+- it cites (``cited_mandate_capsule_id``) the sale's acceptance, found by
+  ``single_commitment.first_sealed_acceptance`` so both checks read the same
+  record: the sale is the ``item_ref``, under any task authority, and an
+  acceptance that is not known (a live history that cannot settle it) is
+  none;
+- that acceptance was sealed for the same recipient (its ``target`` equals
+  the disclosure's);
+- the cited record re-verifies in the ledger.
+
+Anything else fails: no citation, a citation of another sale's or another
+buyer's acceptance, a record that is not a sealed acceptance, a missing
+reference, and a ``representation_class`` that is missing or outside
+``release_classes``.
+
+**Same deal, same buyer** (``binding: same_deal_same_buyer``,
+seller.release_on_acceptance/1.2.0). The disclosure's classes of data
+(``disclosed_classes``) are read, never ``representation_class``. Every
+class must be in ``release_classes``; a disclosure naming none, or any
+other, fails. One whose classes are all in ``pre_acceptance_classes`` (the
+listing's public pickup area) passes to any buyer, before or after any
+acceptance. Anything else passes only when it names its ``item_ref``, its
+``deal_id`` and the counterparty fingerprint its check sealed
+(``counterparty_ids`` under ``counterparty_fp_alg``), and the sale's
+acceptance (``single_commitment.sale_acceptance``, the same record the cited
+binding reads) is known, is in the same deal (``deal_id`` equal), and was
+sealed for the same buyer: its ``thread_counterparty``, which the history
+carries beside the act and no decision seals
+(``report/live_history.py``), is under the same algorithm, and at least one
+per-person identity kind (``email``, ``phone``, ``profile_id``,
+``relay_address``) is on both sides and every such kind on both sides is
+equal; ``name``, ``payee`` and ``domain`` are then not compared: a name is
+written many ways, and the thread default seals ``payee`` from it, while a
+marketplace domain is shared by every stranger on it. When neither side
+seals any per-person kind (an opening that named the buyer by name and
+domain only), the buyer is the same when both sides seal a ``name`` and a
+``domain`` and both are equal; with the deal equal too, that is the thread's
+own buyer. A per-person kind on one side only, a name alone or a domain
+alone is no buyer. The ``payee`` is never compared. The acceptance is not
+cited and not re-verified: the history entries are the producer's own
+sealed records on the user's device, the trust ``single_commitment`` places
+in them. A history that may be missing acts, an act of this sale that could
+not be read, an acceptance-class act with no disposition, or an earlier
+accepted commitment in the history that names no item, leave the
+acceptance unknown, which is none here. The counterparty block must be a
+check's, whole (``history_state.well_formed_counterparty``) on both sides: a
+share whose block holds any member of another kind or shape fails naming
+``counterparty``, so a member dropped for its shape never reads as absent
+(and never opens the name-and-domain reading), and an acceptance whose
+block is not whole carries none, so it binds no share. No acceptance, an unknown one, and
+one in another deal or by another buyer fail with one reason, so a buyer
+cannot learn whether someone else accepted. A share naming no class, or a
+class outside ``release_classes`` (the credential, verification-code, card
+and ID classes), has its own reason: it says nothing about other buyers.
+The rule applies to every recipient but ``except_recipient_roles`` (a
+buyer, a third party, the user), so those classes go to no one but the
+platform.
+
+Under either binding two inputs fail closed: an ``action_class`` that is
+missing or has no row in the action taxonomy (it is resolved there, so a
+legacy alias counts as its canonical class), because the action cannot be
+shown to be out of scope. Only another known action class is ``n/a`` out of
+scope, and, when the wicket configures ``except_recipient_roles`` (1.1.0
+and 1.2.0: ``platform``), a disclosure whose ``recipient_role`` is one of
+them: it goes to no buyer, so there is no acceptance to bind, and
+``recipient_role`` measures what it may carry. The engine lists this as an
+integrity check, so a failure refuses whatever the pack declares; a
+one-shot approval does not clear it.
+
+The outcome carries no value. A checker result is sealed into a record that
+can reach a buyer's copy, so the reason and evidence never hold the
+disclosed data, ``item_ref``, ``task_authority_ref``, a deal, a counterparty
+or a capsule id. The evidence names only the class or classes read (class
+names from a closed set), whether the release was bound to an acceptance,
+and a missing field's name.
+"""
+from __future__ import annotations
+
+from typing import TypedDict
+
+from cll.ledger.api import LedgerAPI
+
+from ..action import Action
+from ..capsule import ConstraintOutcome, NotApplicableEvidence, not_applicable_evidence
+from ..classes import resolve
+from ..history_state import well_formed_counterparty
+from .base import CheckOutcome
+from .single_commitment import ThreadCounterparty, first_sealed_acceptance, sale_acceptance
+
+__all__ = ["SAME_DEAL_SAME_BUYER", "check_release_on_acceptance", "same_buyer"]
+
+_CHECK_ID = "release_on_acceptance"
+_METHOD = "cited_sealed_acceptance_v1"
+_NOT_BOUND = "the disclosure does not cite this sale's sealed acceptance by this recipient"
+# The ``binding`` that binds the acceptance from the history (1.2.0).
+SAME_DEAL_SAME_BUYER = "same_deal_same_buyer"
+_HISTORY_METHOD = "same_deal_same_buyer_v1"
+_NOT_ACCEPTED = "the history given shows no acceptance of this sale by this buyer in this deal"
+# The identity kinds that name one person (capsule-cli deal_counterparty.go
+# perPartyKinds). A name, a payee and a domain are fingerprinted too but are
+# not identities.
+_PER_PERSON_KINDS = ("email", "phone", "profile_id", "relay_address")
+# What names the thread's own buyer when neither side seals a per-person
+# kind: both of these, equal. The payee is never read.
+_NO_PER_PERSON_KINDS = ("name", "domain")
+
+
+class ReleaseEvidence(TypedDict):
+    constraint_id: str
+    representation_class: str | None
+    bound_to_acceptance: bool
+    missing_field: str | None
+
+
+class ClassesEvidence(TypedDict):
+    """1.2.0's evidence: the class names the disclosure gives, never the data."""
+
+    constraint_id: str
+    disclosed_classes: list[str] | None
+    bound_to_acceptance: bool
+    missing_field: str | None
+
+
+def _evidence(representation_class: str | None, bound: bool, missing_field: str | None = None) -> ReleaseEvidence:
+    return ReleaseEvidence(constraint_id=_CHECK_ID, representation_class=representation_class,
+                           bound_to_acceptance=bound, missing_field=missing_field)
+
+
+def _classes_evidence(classes: tuple[str, ...] | None, bound: bool,
+                      missing_field: str | None = None) -> ClassesEvidence:
+    return ClassesEvidence(constraint_id=_CHECK_ID, disclosed_classes=list(classes) if classes else None,
+                           bound_to_acceptance=bound, missing_field=missing_field)
+
+
+def _outcome(result: str, reason: str, evidence: ReleaseEvidence | ClassesEvidence | NotApplicableEvidence,
+             method: str = _METHOD) -> CheckOutcome:
+    return CheckOutcome(
+        constraint=ConstraintOutcome(
+            id=_CHECK_ID, result=result, reason=reason, evidence=evidence, check_type="policy", method=method
+        )
+    )
+
+
+def _missing_shape(action: Action, field: str) -> str:
+    # An ignored input is named, never the value it was given.
+    return f"the {field} input was not in its agreed shape" if field in action.ignored_inputs else f"no {field}"
+
+
+def _missing(action: Action, cls: str, field: str) -> CheckOutcome:
+    return _outcome("fail", f"the disclosure has {_missing_shape(action, field)}; it cannot be bound to an acceptance",
+                    _evidence(cls, False, missing_field=field))
+
+
+def same_buyer(acceptance: ThreadCounterparty | None, fp_alg: str | None, ids: dict[str, str] | None) -> bool:
+    """Whether the counterparty an acceptance's check sealed and the one a
+    disclosure's check sealed are one buyer: both fingerprinted under the
+    same algorithm, and either at least one per-person identity kind on both
+    sides with every per-person kind on both sides equal, or, when neither
+    side seals any per-person kind, both a ``name`` and a ``domain`` on both
+    sides, each equal. A payee is never read (module docstring)."""
+    if acceptance is None or not fp_alg or not ids or acceptance["fp_alg"] != fp_alg:
+        return False
+    theirs = acceptance["ids"]
+    if not any(k in theirs or k in ids for k in _PER_PERSON_KINDS):
+        # The deal is checked apart: this is the thread's own buyer by the
+        # opening's name and domain.
+        return all(k in theirs and k in ids and theirs[k] == ids[k] for k in _NO_PER_PERSON_KINDS)
+    shared = [k for k in _PER_PERSON_KINDS if k in theirs and k in ids]
+    return bool(shared) and all(theirs[k] == ids[k] for k in shared)
+
+
+def check_release_on_acceptance(
+    action: Action,
+    ledger: LedgerAPI,
+    *,
+    release_classes: list[str],
+    acceptance_classes: list[str],
+    action_classes: list[str],
+    except_recipient_roles: list[str] | None = None,
+    binding: str | None = None,
+    pre_acceptance_classes: list[str] | None = None,
+) -> CheckOutcome:
+    """The check under the wicket's ``binding``: cited when it is unset (the
+    1.0.0 and 1.1.0 configs, decided as they always were), from the history
+    under ``same_deal_same_buyer`` (module docstring)."""
+    if binding is not None and binding != SAME_DEAL_SAME_BUYER:
+        raise ValueError(f"release_on_acceptance has no binding {binding!r}")
+    method = _HISTORY_METHOD if binding is not None else _METHOD
+    ac = resolve(action.action_class) if action.action_class is not None else None
+    if ac is None:
+        evidence = (_classes_evidence(action.disclosed_classes, False, missing_field="action_class")
+                    if binding is not None else _evidence(None, False, missing_field="action_class"))
+        return _outcome("fail", "the action class has no taxonomy row; it cannot be shown to be outside the rule",
+                        evidence, method)
+    if ac.name not in action_classes:
+        return _outcome("n/a", "the rule is not configured for this action class",
+                        not_applicable_evidence(_CHECK_ID, in_scope=False), method)
+    if action.recipient_role is not None and action.recipient_role in (except_recipient_roles or ()):
+        return _outcome("n/a", f"the recipient is a {action.recipient_role}, not a buyer; recipient_role measures it",
+                        not_applicable_evidence(_CHECK_ID, in_scope=False), method)
+    if binding is not None:
+        return _release_from_history(action, ledger, release_classes=release_classes,
+                                     acceptance_classes=acceptance_classes,
+                                     pre_acceptance_classes=pre_acceptance_classes or [])
+    cls = action.representation_class
+    if cls not in release_classes:
+        # An undeclared class's name is the producer's free text, never recorded.
+        return _outcome("fail", "the disclosure declares no class this rule knows; it is not released",
+                        _evidence(None, False, missing_field="representation_class"))
+    for field, value in (("task_authority_ref", action.task_authority_ref), ("item_ref", action.item_ref),
+                         ("target", action.target)):
+        if value is None:
+            return _missing(action, cls, field)
+    if action.cited_mandate_capsule_id is None:
+        return _outcome("fail", "the disclosure cites no acceptance", _evidence(cls, False))
+
+    acceptance = first_sealed_acceptance(action.operator, ledger, acceptance_classes, action.item_ref)
+    if (
+        acceptance is None
+        or action.cited_mandate_capsule_id != acceptance["capsule_id"]
+        or action.target != acceptance["counterparty"]
+    ):
+        return _outcome("fail", _NOT_BOUND, _evidence(cls, False))
+    verified = ledger.verify(acceptance["capsule_id"])
+    if verified is None or not verified.ok:
+        return _outcome("fail", _NOT_BOUND, _evidence(cls, False))
+    return _outcome("pass", "the disclosure cites this sale's sealed acceptance by this recipient",
+                    _evidence(cls, True))
+
+
+def _release_from_history(
+    action: Action,
+    ledger: LedgerAPI,
+    *,
+    release_classes: list[str],
+    acceptance_classes: list[str],
+    pre_acceptance_classes: list[str],
+) -> CheckOutcome:
+    """The same-deal, same-buyer binding (1.2.0) for a disclosure in scope."""
+    classes = action.disclosed_classes
+    if classes is None:
+        return _outcome("fail", "the share names no class of data",
+                        _classes_evidence(None, False, missing_field="disclosed_classes"), _HISTORY_METHOD)
+    if any(c not in release_classes for c in classes):
+        return _outcome("fail", "a credential, a verification code, a payment card or an ID document is never shared "
+                        "with anyone",
+                        _classes_evidence(classes, False), _HISTORY_METHOD)
+    if all(c in pre_acceptance_classes for c in classes):
+        return _outcome("pass", "every class the disclosure names may go to a buyer before acceptance",
+                        _classes_evidence(classes, False), _HISTORY_METHOD)
+    for field, present in (("item_ref", action.item_ref is not None), ("deal_id", action.deal_id is not None),
+                           ("counterparty", bool(action.counterparty_ids) and bool(action.counterparty_fp_alg))):
+        if not present:
+            return _outcome("fail", f"the disclosure has {_missing_shape(action, field)}; it cannot be bound to an "
+                            "acceptance", _classes_evidence(classes, False, missing_field=field), _HISTORY_METHOD)
+    if action.counterparty_malformed or not well_formed_counterparty(action.counterparty_fp_alg,
+                                                                      action.counterparty_ids):
+        # A member dropped for its shape must not read as absent: the whole
+        # block is unusable.
+        return _outcome("fail", "the counterparty input was not in its agreed shape; it cannot be bound to an "
+                        "acceptance", _classes_evidence(classes, False, missing_field="counterparty"),
+                        _HISTORY_METHOD)
+    sale = sale_acceptance(action.operator, ledger, acceptance_classes, action.item_ref)
+    acceptance = sale.acceptance if sale.unknown is None else None
+    if (
+        acceptance is None
+        or acceptance["deal_id"] != action.deal_id
+        or not same_buyer(acceptance["thread_counterparty"], action.counterparty_fp_alg, action.counterparty_ids)
+    ):
+        return _outcome("fail", _NOT_ACCEPTED, _classes_evidence(classes, False), _HISTORY_METHOD)
+    return _outcome("pass", "the history given shows this buyer accepted this sale in this deal",
+                    _classes_evidence(classes, True), _HISTORY_METHOD)

capsule_engine/guards/checks/required_disclosure.py

@@ -0,0 +1,233 @@
+# SPDX-License-Identifier: Apache-2.0
+"""required_disclosure check: has each required class of statement been
+made to this counterparty before the action?
+
+For each class in ``required_classes``, the count is the
+``disclosure.class_seen`` fold's own result, keyed by
+``asg_payload.representation_class``, over this operator's records addressed
+to ``Action.target``. Only accepted actions that were not dry runs count. A
+zero for any required class fails the check; the evidence lists each class's
+count and the classes still missing. It checks that a statement of the class
+was recorded, never what it said or whether it was true. Applies only to
+the configured ``action_classes``.
+
+A failure means the action cannot proceed as constructed: make the
+disclosure first, or change the task authority. It is never cleared by an
+approval: this check reads no approval record and ignores
+``Action.authorized_by``, because a one-shot approval does not waive a
+statement the person already required.
+
+With ``statement_definition`` (``required_disclosure/1.1.0``, its fold
+``disclosure.statement_seen/1.0.0``), a class also counts as stated when the
+action's deal (``Action.deal_id``) already holds a statement of it: a record
+``report/replay.py``'s ``statement_record`` wrote for a claim the seller's
+agent made in that deal before the action, read from the bundle in a replay
+and from the check input's history live. Both counts are in the evidence,
+the deal's beside the counterparty's. The deal stands for the counterparty
+here: capsulectl opens one thread per buyer. A statement record names no
+counterparty, so a counterparty that changes within a deal is not seen here
+(``counterparty_identity_change`` reads that). An action with neither a
+target nor a deal is not applicable, as one with no target is without it;
+one with a target and no deal counts the counterparty's statements only, and
+one with a deal and no target the deal's only.
+
+With ``count_listing_classes`` (``required_disclosure/1.2.0``), a class also
+counts as stated when it is in ``Action.listing_classes``: the classes every
+live listing of the sale stated when the check was made, as capsulectl sealed
+them in the check's body (the intersection over the latest post per platform).
+A listing is the agent's words to every buyer, so a class it states is stated
+to this one too. The value is read from the check, never recomputed: a re-post
+changes later checks only. With no value (no post) or an empty one, a listing
+counts for nothing, and the class needs one of the other two paths. The
+evidence lists the value beside the two counts.
+
+``required_classes`` must come from the closed set ``representation_classes``;
+a class outside it is a configuration error and raises ``ValueError``.
+"""
+from __future__ import annotations
+
+from typing import TypedDict
+
+from cll.ledger.api import LedgerAPI, ScanQuery
+
+from ...folds.definition import FoldDefinition
+from ...folds.engine import EvaluationTrace, evaluate_one
+from ..action import Action
+from ..capsule import ConstraintOutcome, NotApplicableEvidence, not_applicable_evidence
+from ..statements import STATED
+from .base import CheckOutcome
+
+__all__ = ["check_required_disclosure", "require_known_classes"]
+
+_CHECK_ID = "required_disclosure"
+
+
+class DisclosureScope(TypedDict):
+    operator: str
+    target: str
+
+
+class DisclosureEvidence(TypedDict):
+    fold: str
+    scope: DisclosureScope
+    prior_counts: dict[str, int]
+    missing_classes: list[str]
+
+
+class StatementScope(TypedDict):
+    operator: str
+    target: str | None
+    deal_id: str | None
+
+
+class StatementEvidence(TypedDict):
+    """``required_disclosure/1.1.0``'s evidence: each fold's digest and
+    counts, and the classes neither counted."""
+
+    fold: str
+    statement_fold: str
+    scope: StatementScope
+    prior_counts: dict[str, int]
+    stated_counts: dict[str, int]
+    missing_classes: list[str]
+
+
+class ListingEvidence(StatementEvidence):
+    """``required_disclosure/1.2.0``'s evidence: 1.1.0's, and the listing's
+    classes the action carried (``None`` with no post)."""
+
+    listing_classes: list[str] | None
+
+
+def require_known_classes(classes: list[str], representation_classes: list[str], *, what: str) -> None:
+    unknown = [c for c in classes if c not in representation_classes]
+    if unknown:
+        raise ValueError(f"{what} names {unknown}, outside the closed set {representation_classes}")
+
+
+def _outcome(
+    result: str, reason: str, evidence: DisclosureEvidence | StatementEvidence | NotApplicableEvidence, method: str,
+    traces: tuple[EvaluationTrace, ...] = (),
+) -> CheckOutcome:
+    return CheckOutcome(
+        constraint=ConstraintOutcome(
+            id=_CHECK_ID, result=result, reason=reason, evidence=evidence, check_type="policy", method=method
+        ),
+        fold_envelopes=tuple(trace.to_envelope() for trace in traces),
+    )
+
+
+def check_required_disclosure(
+    action: Action,
+    ledger: LedgerAPI,
+    *,
+    definition: FoldDefinition,
+    representation_classes: list[str],
+    required_classes: list[str],
+    action_classes: list[str],
+    statement_definition: FoldDefinition | None = None,
+    count_listing_classes: bool = False,
+) -> CheckOutcome:
+    require_known_classes(required_classes, representation_classes, what="required_classes")
+    if count_listing_classes and statement_definition is None:
+        raise ValueError("count_listing_classes goes with statement_fold_id: required_disclosure/1.2.0 builds on 1.1.0")
+    method = definition.fold_id
+    if action.action_class not in action_classes:
+        return _outcome("n/a", "the rule is not configured for this action class",
+                        not_applicable_evidence(_CHECK_ID, in_scope=False), method)
+    if statement_definition is not None:
+        return _check_with_statements(action, ledger, definition, statement_definition, required_classes,
+                                      listing=count_listing_classes)
+    target = action.target
+    if target is None:
+        return _outcome("n/a", "the action names no target; the counterparty could not be identified",
+                        not_applicable_evidence(_CHECK_ID, in_scope=True, missing_field="target"), method)
+
+    traces = _counted(definition, _to_target(action, ledger, target), required_classes)
+    counts = _counts(traces, required_classes)
+    missing = [cls for cls in required_classes if counts[cls] == 0]
+    evidence = DisclosureEvidence(
+        fold=definition.definition_digest(),
+        scope=DisclosureScope(operator=action.operator, target=target),
+        prior_counts=counts,
+        missing_classes=missing,
+    )
+    return _decided(missing, evidence, method, traces)
+
+
+def _to_target(action: Action, ledger: LedgerAPI, target: str) -> list[dict]:
+    """This operator's records addressed to ``target``. ``ScanQuery.
+    counterparty`` is the ledger's filter on ``operator``; the ledger has no
+    filter on target, so the records are selected here."""
+    return [
+        r.capsule for r in ledger.scan(ScanQuery(counterparty=action.operator))
+        if (r.capsule.get("asg_payload") or {}).get("target") == target
+    ]
+
+
+def _in_deal(action: Action, ledger: LedgerAPI, deal_id: str) -> list[dict]:
+    """This operator's statement records in the deal ``deal_id``."""
+    return [
+        r.capsule for r in ledger.scan(ScanQuery(counterparty=action.operator))
+        if (((r.capsule.get("asg_payload") or {}).get(STATED)) or {}).get("deal_id") == deal_id
+    ]
+
+
+def _counted(definition: FoldDefinition, records: list[dict], classes: list[str]) -> tuple[EvaluationTrace, ...]:
+    return tuple(evaluate_one(definition, records, key_value=cls) for cls in classes)
+
+
+def _counts(traces: tuple[EvaluationTrace, ...], classes: list[str]) -> dict[str, int]:
+    return {cls: trace.result or 0 for cls, trace in zip(classes, traces, strict=True)}
+
+
+def _decided(
+    missing: list[str], evidence: DisclosureEvidence | StatementEvidence | ListingEvidence, method: str,
+    traces: tuple[EvaluationTrace, ...],
+) -> CheckOutcome:
+    if missing:
+        return _outcome("fail", f"no accepted prior statement of {missing} to this counterparty: make the disclosure "
+                                 "first or change the task authority; an approval does not waive it", evidence, method,
+                        traces)
+    return _outcome("pass", "every required class was stated to this counterparty", evidence, method, traces)
+
+
+def _check_with_statements(
+    action: Action, ledger: LedgerAPI, definition: FoldDefinition, statement_definition: FoldDefinition,
+    required_classes: list[str], *, listing: bool = False,
+) -> CheckOutcome:
+    """``required_disclosure/1.1.0``: a class counts as stated to the
+    counterparty's target or in the action's deal; with ``listing`` (1.2.0),
+    also when the sale's listings in force state it (module docstring)."""
+    method = definition.fold_id
+    target, deal_id = action.target, action.deal_id
+    if target is None and deal_id is None:
+        return _outcome("n/a", "the action names no target and no deal; the counterparty could not be identified",
+                        not_applicable_evidence(_CHECK_ID, in_scope=True, missing_field="target"), method)
+    told = _counted(definition, _to_target(action, ledger, target) if target is not None else [], required_classes)
+    stated = _counted(statement_definition, _in_deal(action, ledger, deal_id) if deal_id is not None else [],
+                      required_classes)
+    prior, in_deal = _counts(told, required_classes), _counts(stated, required_classes)
+    listed = action.listing_classes if listing and action.listing_classes is not None else ()
+    missing = [cls for cls in required_classes if prior[cls] == 0 and in_deal[cls] == 0 and cls not in listed]
+    scope = StatementScope(operator=action.operator, target=target, deal_id=deal_id)
+    if listing:
+        evidence: StatementEvidence = ListingEvidence(
+            fold=definition.definition_digest(),
+            statement_fold=statement_definition.definition_digest(),
+            scope=scope,
+            prior_counts=prior,
+            stated_counts=in_deal,
+            missing_classes=missing,
+            listing_classes=None if action.listing_classes is None else list(action.listing_classes),
+        )
+    else:
+        evidence = StatementEvidence(
+            fold=definition.definition_digest(),
+            statement_fold=statement_definition.definition_digest(),
+            scope=scope,
+            prior_counts=prior,
+            stated_counts=in_deal,
+            missing_classes=missing,
+        )
+    return _decided(missing, evidence, method, told + stated)