Analysis

Analyzer reports

Every bundle carries a machine-generated report: rule reachability, overlaps, default-deny coverage, semantic diff, replay summary, and control coverage.

The language is total, loop-free, and typed, which keeps whole-bundle questions decidable: whether a rule can ever match, whether two rules overlap, which region of the context space falls through to default deny. The analyzer answers these questions statically and attaches the report to the package; the activation event binds the report root, making the analysis part of the evidence rather than a build log.

The analyzer report is evidence input. Every counterexample is re-executed through the reference evaluator, and the governance reducer checks the diff classification against the report root before activation.

Report contents

  • Reachability (hard failure). Unsatisfiable guards block progression and carry the rule id, schema root, and the unsat predicate set.
  • Overlaps (report). Permit/permit and permit/forbid overlaps with witness contexts. Deny-overrides resolves verdicts; reviewers receive every witness.
  • Default-deny coverage (sign-off). Representative operations that fall through to default deny. The sign-off records whether the fall-through region is intended.
  • Semantic diff (governance path). Tightens / loosens / mixed / equivalent, with counterexample operations per direction.
  • Control map. Rules grouped by control reference, with match statistics from recorded traces and shadow projections.
  • Replay summary. Active-versus-candidate decisions over the configured traffic window, grouped by desk, control, rule, and decision direction.

Report envelope

The report root is part of the PolicyPackage and part of the activation event. Governance signatures cover both roots, so reviewers sign the package and the analysis artifact together.

AnalyzerReport
json
{
  "kind": "AnalyzerReport",
  "package_root": "cid:pkg_v43",
  "schema_root": "cid:schema_custody_v3",
  "active_package_root": "cid:pkg_v42",
  "classification": "LOOSENS",
  "generated_at": "2026-07-01T14:20:00Z",
  "gates": {
    "schema_check": "PASS",
    "verifier": "PASS",
    "reachability": "PASS",
    "coverage": "SIGNOFF_REQUIRED",
    "semantic_diff": "ELEVATED_GOVERNANCE",
    "replay": "ATTACHED"
  },
  "roots": {
    "findings": "cid:findings",
    "counterexamples": "cid:counterexamples",
    "replay_summary": "cid:replay"
  }
}

Gate mapping

  • PASS: the package can progress through the current gate.
  • HARD_FAIL: activation flow stops at analysis and points to a concrete rule, schema field, or bytecode verifier error.
  • SIGNOFF_REQUIRED: reviewers receive representative examples and record a signed disposition.
  • ELEVATED_GOVERNANCE: the diff class selects quorum, timelock, replay, and shadow requirements.

Reading a diff entry

Semantic diff excerpt
json
{
  "classification": "LOOSENS",
  "added_rules": ["defi-desk-swaps"],
  "counterexamples": [{
    "direction": "denied_before_allowed_after",
    "context": {
      "operation": "Sign", "asset": "USDC",
      "amount": "USDC 48_000.00",
      "destination": "0x7ac1…9e (defi_router_v2)",
      "requester_role": "DefiTrader"
    },
    "before": { "decision": "DENY", "reason": "NO_MATCHING_PERMIT" },
    "after":  { "decision": "ALLOW",
                "obligations": ["approval 2 of defi_desk_leads"] }
  }],
  "unchanged_proven_for": ["all forbid rules",
                           "ops desk traffic", "treasury desk traffic"]
}