Skip to content

v0.1.0 — W0: Reference oracle & property harness

Latest
Latest

Choose a tag to compare

View all tags
@geminimir geminimir released this 14 Jul 21:49
v0.1.0
fdddbea

First public cut. Milestone W0 — the reference oracle and property harness — is complete.

Everything downstream (the real ReBAC engine, retrieval, gateway, agent lifecycle) is judged against what ships in this release. Nothing else is here yet, on purpose.

What's in it

core/algebra.py — the formal permission spec, in one file, as executable module docstring plus dataclasses.

authorized(u, d, t) := allow(u, d, t) AND NOT blocked(u, d)
deny dominates. MAX_DEPTH = 8. tag(b, side) = b*2 + side.

core/oracle.py — brute-force reference implementation (~180 LOC). BFS-per-principal, cycle-safe via visited set, depth-limited, deny short-circuits. Deliberately unoptimized: if it becomes hot, the fix is to use the real engine (W1), not to optimize this file. Returns (bool, ReasonPath) — the reason path is the chain of tuples that produced the decision, which is what makes the future audit log usable.

evals/generators.py — Hypothesis strategies for adversarial graphs:

  • deep nesting (5+ hops)
  • cyclic memberships that must terminate
  • a principal on both sides of a barrier
  • mid-test tuple expiry
  • a doc reachable by 3 independent grant paths, one revoked

evals/differential.py — three property tests: safety, fidelity, pointwise-check(). Currently xfail(strict=True, raises=EngineNotImplemented) because the seam (core.rebac.check) doesn't exist yet. The moment W1 wires it in, XPASS breaks the build and the marker comes off — turning the harness into a real gate rather than a hopeful one.

tests/ — 20 tests, all green: 15 handwritten oracle fixtures + 5 generator sanity tests.

.github/workflows/ci.yml — oracle + generator job (required) and differential job (currently xfail).

Test state

20 passed, 3 xfailed, 0 failed

What's NOT in it (explicit non-goals for this release)

  • No real engine. core/rebac.py lands in W1.
  • No Postgres, no pgvector, no Redis. W1 and W2.
  • No gateway, no session, no agent loop. W3.
  • No benchmarks, no adversarial scenarios. W4.
  • No demo, no adapters, no docker-compose. W5.

If you're evaluating this against Warden's resume claims: none of them are testable yet. That's expected — this release ships the seatbelt, not the car.

Try it

git clone https://github.com/geminimir/warden.git
cd warden
make install
make oracle          # 15 handwritten fixture tests, all green
make differential    # 3 xfail (waiting on W1)

Up next

W1 — ReBAC core. Acceptance gate: differential harness green across at least 5,000 generated graphs. When that lands, the xfail marker in evals/differential.py comes off — and every future PR is protected against silent authorization regressions.

Assets 2
Loading