Where certainty comes from

The proof sources a rule may rest on. Nothing else is admitted, which is what keeps the rule set free of guesses.

Description

Every rule’s proof is one of these, and nothing else is admitted — no patterns over strings, no “usually a mistake”, no near-matches:

• The engine’s own evaluation. The datalogic compiler reports when it folded a condition to a constant; the evaluator, with Orion’s operators registered, is run on exactly the context the serving engine will have.
• Ingress facts established in the code. When a workflow is selected, data and temp_data are empty — the request body is the payload, which only parse_json brings into data; metadata.vars is stamped from [vars] and cannot be caller-supplied; payload is not in the context at all.
• Engine semantics read from source. A terminal task halts after it ran; a terminal group halts when its span closes; channel_call fails at max_channel_call_depth; map applies mappings in order.
• The function registry. Which functions write only their target; which input fields the engine evaluates.
• Structural identity. Byte-identical after ids and names are stripped.
• The config you passed with -c. The [vars] and [secrets] the serving instance declares.

Related

• Advisory checks: every rule, with its level and scope.
• orion-server clippy: the command, its flags and exit codes.
• orion-server lint: the gate that runs first, and must pass.
• Test workflows offline: running the rules against a set.

Last verified 14 September 2026