The Invariant
Every rule evaluated by the platform is a pure function of (payload, context, db state). The expression language is deterministic by construction — there are no function calls in the grammar, so a manifest cannot express now(), random() or uuid(). The same event replayed on the same state produces the same verdict, forever.
The Contract
Three engines share the same expression evaluator:
- formula_engine — named computed values (
weight_delta_pct,tempo_std) other rules reference as$formula.*. - constraint_engine —
pre_commit_rulesbound to triggers; afalseverdict rejects the action. - data_link_engine — declarative
SELECT/INSERT/UPDATEagainstbiz_*tables, executed inside the action transaction.
Scope prefixes: $payload (caller input), $context (session: operatorId, tenant), $db (lookup), $formula (computed values). Anything outside these scopes is rejected at manifest load.
The Flow
- The action engine binds
$payloadfrom the request and$contextfrom the session. - Formulas referenced by the trigger’s constraints are evaluated first.
- Each
pre_commit_rulefor the trigger is evaluated; anyfalse→CONSTRAINT_VIOLATED, rollback. - On success the trigger’s data-link query runs — SQL is generated from the manifest mapping, never interpolated from raw input.
- Results land in the same commit as the FSM transition and audit row.
Payload Example
// fragment of manifests/LayoutManifest.production-line.example.json
{
"formula_engine": {
"weight_delta_pct": "(($payload.peso_misurato - $payload.peso_dichiarato) / $payload.peso_dichiarato) * 100"
},
"constraint_engine": {
"pre_commit_rules": [{
"id": "peso_coerente",
"expression": "$formula.weight_delta_pct <= 0.5 && $formula.weight_delta_pct >= -0.5",
"error_message": "Peso misurato fuori tolleranza rispetto al dichiarato",
"triggers": ["ACCEPT_LOT"]
}]
},
"data_link_engine": {
"queries": {
"ACCEPT_LOT": {
"type": "INSERT", "table": "biz_lotti",
"mapping": { "lotto": "$payload.lot_id",
"peso_misurato": "$payload.peso_misurato",
"operator_id": "$context.operatorId" }
}
}
}
}
Known Failures
| Symptom | Cause |
|---|---|
| Manifest rejected at load | Expression outside the grammar (function call, unknown scope) — rewrite against $payload/$context/$db/$formula |
CONSTRAINT_VIOLATED on valid-looking data |
A formula upstream produced an out-of-envelope value — evaluate it on the same payload |
Non-biz_ table error |
Data-link writes are restricted to the biz_ schema surface by the SQL guard |
| Rule fires on the wrong trigger | triggers: [...] list too broad — constraints are opt-in per trigger |