Home / Projects / Orchestrata Ultimate / Decisions / ADR index / ADR-0006
ADR-0006: Projection is rule-driven, with a completeness meta-check
| field | value |
|---|---|
| Status | Accepted |
| Date | 2026-07-23 |
| Register | factory (docs/adr, 4-digit ids) |
| Source | docs/adr/0006-rule-driven-projection-with-completeness-check.md — permalink at bdafa201a (unchanged on master since that commit) |
| Wiki register entry | ADR-0006 (wiki status: Accepted) |
The record
- Status: Accepted
- Date: 2026-07-23
- Spec: SPEC-033 §4
Context
Per ADR-0005, Prolog reasons over a projection — the "relevant" subgraph — rather than the whole fact store. The rulebase uses negation-as-failure, which was the stated reason for rejecting Cypher as the reasoning language.
NAF is only sound under a closed world. A projection is an open world unless it is provably
complete for every predicate the rules consult. If the projection under-selects, a violating fact is
simply absent and the rule reports success: no_orphans passes because the orphan was never
projected.
This is the worst failure class in the system — a silent false-green. Nothing escalates, nothing errors; the gate simply approves. "Relevant" was doing unexamined, load-bearing work.
Decision
The projection is generated from the rules, not chosen by hand.
- Each rule's required predicates are derived by static analysis of the rule ASTs, transitively through the Prolog call graph.
- Any manual declaration is a cross-check only, never the source of truth (a hand-maintained declaration can under-declare, reintroducing the same hole one level up).
- A meta-check asserts projection completeness before the rulebase runs; incomplete projection is a gate error, and in factory mode that fails closed (ADR-0002).
Alternatives rejected
- Hand-declared required predicates — an under-declaration silently restores the false-green.
- Project the entire graph every check — sound but defeats the purpose of projection at scale.
- Abandon NAF — would remove the expressiveness that justified choosing Prolog at all.
Consequences
- Static analysis of the rule call graph must be decidable — which requires banning dynamic predicate construction in governance rules (ADR-0025). That ban is load-bearing here and in ADR-0010; without it this mechanism is unsound.
- Adding a rule automatically widens its projection; no separate maintenance step, and no drift between "what the rule reads" and "what it is given".
Provenance
Round-2 Fable identified NAF-over-partial-projection as an unsoundness with a concrete false-green scenario. Round-3 Fable closed the residual: derive predicates by static analysis rather than trust manual declarations, and noted the dependency on banning meta-predicates.
Related ADRs
Rulings cited
None.