One altered field.
Zero callbacks.
A host rule must match the proposed tool, effect, and resource together. Change any one field in this local fixture and the callback is never entered. Explore all eight combinations, including the cases the larger dispatch matrix missed.
The rule-match lattice.
Each panel fixes the resource relationship. Its four cells vary tool and effect. Select any cell to inspect the actual proposal, policy rule, receipt, and callback count.
Loading the checked-in eight-case report…
Loading the selected case…
| FIELD | PROPOSAL | POLICY RULE | COMPARISON |
|---|
Canonical proposal SHA-256:
Inspect this raw case
The blind spots became tests.
The 384-case dispatch matrix detects seven selected source changes. Two more changes, which make tool or effect comparisons unconditional, leave that matrix untouched. This eight-case lattice exposes each of them in one row. A changing-getter fixture exposes one more receipt-binding flaw, now fixed. The three suites detect all ten selected changes.
Inspect the receipt-binding fix ↗ · Mutation report ↗How to reproduce it.
The Node runner calls the reference dispatchAction once per tool/effect/resource combination. A separately coded Python oracle checks all eight rows, including the canonical proposal digest, field bindings, receipts, and callback entries. CI also rejects deliberately false reports and reruns ten one-at-a-time source substitutions across three checked-in suites.
Run node pilots/action-boundary/policy-tuple.mjs --check, python3 pilots/action-boundary/verify_policy_tuple.py docs/action-policy-tuple.json, and node pilots/action-boundary/dispatch-mutants.mjs --check. Read the method and limits ↗
Scope: One valid allow rule, one returning in-memory callback, three binary field comparisons, and selected source mutations. There is no human approval, provider call, delivery, arbitrary policy set, outside witness, or formal proof of production safety. This browser view presents a checked-in report; it does not independently verify provenance.