"""Author-only executable examples of proposed rules, using synthetic facts. Not an authenticator, reference resolver, sandbox, process observer, or runtime validator. Input facts are fixture assumptions, never evidence of real state. """ def evaluate(case): kind, data = case['kind'], case['input'] if kind == 'reference': target = data['target'] return bool(target and not data['pruned'] and all( target[key] == data['reference'][key] for key in ('kind', 'id', 'scope', 'revision', 'digest') )) if kind == 'permission': if not data['authenticated'] or not data['intentCurrent']: return False required = ['agent', 'project', 'workspace', 'execution'] if data['assigned']: required += ['mission', 'task'] elif data['operation'] not in ['work.read', 'file.read']: return False layers = data['layers'] return all(name in layers and layers[name] is not None and data['operation'] in layers[name] for name in required) if kind == 'path': path = data['path'].split('/') if any(part in ('', '.', '..') for part in path): return False return any(grant is None or path[:len(grant.split('/'))] == grant.split('/') for grant in data['grants']) if kind == 'acceptance': return (data['reviewerAuthorized'] and data['reviewer'] not in data['authors'] and bool(data['requiredCriteria']) and set(data['requiredCriteria']) == set(data['verifiedCriteria'])) if kind == 'claim': # Read events as externally supplied observations. This never observes a process. active, uncertain, audit, generation = False, False, True, 1 answers = [] for event in data['events']: op = event['operation'] if op == 'audit-failed': audit = False elif op == 'audit-restored': audit = True elif op == 'uncertain-effects': uncertain = True elif op == 'verified-stopped-and-reconciled': if audit: active, uncertain = False, False generation += 1 elif op == 'engine-idle': pass # Not proof that commands/processes have stopped. elif op == 'launch': allowed = audit and not active and not uncertain answers.append(allowed) if allowed: active = True elif op == 'input': answers.append(audit and active and not uncertain and event['generation'] == generation) else: raise ValueError(op) return answers raise ValueError(kind)