fix: add explicit decimal grounding equality

Author: Navaneeth-pk

actionrail/sdk/grounding/match.py

@@ -68,14 +68,22 @@ def _compare_dt(actual_dt, op: str, threshold) -> bool:
             "eq": actual_dt == threshold, "ne": actual_dt != threshold}.get(op, False)
 
 
-def _compare(actual, op: str, expected) -> bool:
+def _compare(actual, op: str, expected, value_type: str | None = None) -> bool:
     if op in ("set", "empty"):
         is_empty = actual is None or str(actual) == ""
         return is_empty if op == "empty" else not is_empty
     if op == "in":
         return str(actual) in [s.strip() for s in str(expected).split(",")]
     if op == "contains":
         return str(expected) in str(actual)
+    if value_type == "decimal":
+        a, e = finite_decimal(actual), finite_decimal(expected)
+        if a is None or e is None:
+            return False
+        if op == "eq":
+            return a == e
+        if op == "ne":
+            return a != e
     if op in ("gt", "gte", "lt", "lte"):
         a, e = finite_decimal(actual), finite_decimal(expected)
         if a is None or e is None:
@@ -117,7 +125,7 @@ def _eval_column(m: dict, record: dict, ctx: dict, args: dict, value) -> str | N
             expected, shown = m.get("value"), repr(m.get("value"))
         else:
             expected, shown = None, ""
-        ok = _compare(actual, op, expected)
+        ok = _compare(actual, op, expected, m.get("type"))
     if ok:
         return None
     return f"{col}={actual} fails: {col} {_OP_LABEL.get(op, op)} {shown}".strip()

actionrail/sdk/rule_validation.py

@@ -11,6 +11,7 @@
 import math
 import re
 
+from .numeric import finite_decimal
 from .policy import parse_policy
 
 _COLUMN_OPERATORS = {"eq", "ne", "gt", "gte", "lt", "lte", "contains", "in", "set", "empty"}
@@ -143,7 +144,7 @@ def _validate_condition(
 
     errors = _unknown_fields(
         condition,
-        {"column", "op", "ctx", "arg", "value", "now"},
+        {"column", "op", "ctx", "arg", "value", "now", "type"},
         tool=tool,
         arg=arg,
         field=field,
@@ -159,6 +160,17 @@ def _validate_condition(
         ))
         return errors
 
+    value_type = condition.get("type")
+    if value_type is not None:
+        if value_type != "decimal":
+            errors.append(_issue(
+                tool, arg, field, "condition_type", "Condition type must be decimal when specified."
+            ))
+        elif operator not in {"eq", "ne"}:
+            errors.append(_issue(
+                tool, arg, field, "condition_type_operator", "Decimal type is supported only with eq or ne."
+            ))
+
     targets = [name for name in ("ctx", "arg", "value", "now") if name in condition]
     if operator in _NO_TARGET_OPERATORS:
         if targets:
@@ -188,6 +200,10 @@ def _validate_condition(
             isinstance(target_value, float) and not math.isfinite(target_value)
         ):
             errors.append(_issue(tool, arg, field, "condition_value", "Comparison value must be a finite scalar."))
+        if value_type == "decimal" and finite_decimal(target_value) is None:
+            errors.append(_issue(
+                tool, arg, field, "condition_decimal_value", "Decimal comparison value must be finite numeric data."
+            ))
     if target == "now":
         if operator not in _TIME_OPERATORS:
             errors.append(_issue(tool, arg, field, "time_operator", "Time comparisons require eq, ne, gt, gte, lt, or lte."))

docs/docs/rules/match-conditions.mdx

@@ -52,6 +52,21 @@ Another proposed tool argument:
   arg: amount
 ```
 
+Exact decimal equality for a money field must be declared explicitly:
+
+```yaml
+- column: amount_due
+  op: eq
+  arg: amount
+  type: decimal
+```
+
+`type: decimal` is valid with `eq` and `ne`. Both operands are parsed by the
+same exact, finite `Decimal` path used by ActionRail policies. It treats
+`1250`, `1250.0`, and `"1250.00"` as the same number without rounding, while
+invalid, Boolean, NaN, and infinite inputs fail closed. Do not apply this type
+to identifiers, account numbers, or scopes where formatting is meaningful.
+
 The current time plus an optional offset:
 
 ```yaml
@@ -66,8 +81,8 @@ Time offsets support `s`, `m`, `h`, `d`, and `w`, such as `-15m`, `+1h`, or `-30
 
 | Operator | Meaning | Comparison behavior |
 | --- | --- | --- |
-| `eq` | equal | String equality; default. |
-| `ne` | not equal | String inequality. |
+| `eq` | equal | String equality by default; exact numeric equality with `type: decimal`. |
+| `ne` | not equal | String inequality by default; exact numeric inequality with `type: decimal`. |
 | `gt` | greater than | Numeric conversion. |
 | `gte` | greater than or equal | Numeric conversion. |
 | `lt` | less than | Numeric conversion. |

docs/numeric-grounding-connector-audit-2026-07-19.md

@@ -0,0 +1,46 @@
+# Numeric grounding connector audit
+
+This audit separates the benchmark fixture defect from shipped connector risk.
+It covers the SQLite, PostgreSQL, MySQL, HTTP, and MCP grounding sources.
+
+## Finding
+
+Every shipped connector delegates returned-record conditions to
+`actionrail.sdk.grounding.match.evaluate`. Before this repair, its `eq` and `ne`
+operators compared `str(actual)` with `str(expected)`. Numeric values returned
+as `1250.0` therefore differed from proposed values serialized as `1250`.
+
+| Connector | Proposed value transport | Returned-record comparison | Exposure before repair |
+| --- | --- | --- | --- |
+| SQLite | Bound query parameter | Shared `evaluate` matcher | Yes for `eq`/`ne` column conditions |
+| PostgreSQL | Bound query parameter | Shared `evaluate` matcher | Yes for `eq`/`ne` column conditions |
+| MySQL | Bound query parameter | Shared `evaluate` matcher | Yes for `eq`/`ne` column conditions |
+| HTTP | Path/request interpolation | Shared `evaluate` matcher | Yes for JSON numeric `eq`/`ne` conditions |
+| MCP | Structured tool arguments | Shared `evaluate` matcher | Yes for structured numeric `eq`/`ne` conditions |
+
+Queries that directly compare a bound `:value` with a database column use the
+database's own equality semantics. That path is not the defect. The exposed path
+is a returned record subsequently compared by ActionRail's shared matcher.
+
+## Repair contract
+
+Money fields opt into `type: decimal` on an `eq` or `ne` column condition. Both
+operands use the existing `finite_decimal()` implementation shared with policy
+evaluation. Comparison is exact and never rounds through `float`.
+
+Plain `eq` and `ne` remain string comparisons. Numeric-looking identifiers,
+accounts, and scopes therefore retain their original formatting semantics.
+Invalid, Boolean, non-finite, or excessively large decimal inputs fail closed.
+
+Database schema inference is intentionally not used as an authority: arbitrary
+queries may contain casts, aliases, expressions, and views. Connector metadata
+may support future configuration validation, but the rule's explicit field
+contract controls security behavior.
+
+## Regression coverage
+
+Tests cover integer/float equivalence, zero, cents, numeric strings, sub-cent
+inequality, non-finite values, identifier isolation, rule validation, shared
+record evaluation, and SQLite connector behavior. Because all five connectors
+call the same matcher, the shared tests exercise the production comparison path
+used by each connector.

tests/test_operators.py

@@ -32,6 +32,33 @@ def test_compare(actual, op, expected, result):
     assert _compare(actual, op, expected) is result
 
 
+@pytest.mark.parametrize(
+    ("actual", "expected", "result"),
+    [
+        (1250, 1250.0, True),
+        (0, 0.0, True),
+        ("86.40", 86.4, True),
+        (1250.001, "1250.00", False),
+        ("00123", "123", True),
+        (float("nan"), 0, False),
+        (float("inf"), 0, False),
+        (True, 1, False),
+    ],
+)
+def test_decimal_equality_uses_shared_exact_numeric_path(actual, expected, result):
+    assert _compare(actual, "eq", expected, "decimal") is result
+
+
+def test_numeric_contract_is_explicit_and_does_not_leak_to_identifiers():
+    assert _compare("00123", "eq", "123") is False
+    assert _compare("1250", "eq", 1250) is True
+    assert _compare("1250", "eq", 1250, "decimal") is True
+
+
+def test_decimal_inequality_fails_closed_for_invalid_values():
+    assert _compare("not-a-number", "ne", 0, "decimal") is False
+
+
 def test_parse_offset():
     assert _parse_offset("") == timedelta(0)
     assert _parse_offset("0") == timedelta(0)
@@ -71,6 +98,13 @@ def test_evaluate_operand_free_column_ops():
     assert evaluate(1, {"note": ""}, empty, {}, {}, "A").grounded
 
 
+def test_evaluate_decimal_field_contract():
+    check = {"match": [{"column": "amount", "op": "eq", "arg": "amount", "type": "decimal"}]}
+    assert evaluate(1, {"amount": 1250.0}, check, {}, {"amount": 1250}, "invoice").grounded
+    assert evaluate(1, {"amount": 86.4}, check, {}, {"amount": "86.40"}, "invoice").grounded
+    assert not evaluate(1, {"amount": 1250.0}, check, {}, {"amount": 1250.001}, "invoice").grounded
+
+
 def test_compare_dt():
     ref = datetime(2026, 1, 1, tzinfo=timezone.utc)
     assert _compare_dt(None, "gt", ref) is False           # unparseable actual -> safe False

tests/test_rule_validation.py

@@ -164,6 +164,9 @@ def test_retry_shape_and_types_are_fail_closed(retry, code):
     ({"column": "owner", "value": float("inf")}, "condition_value"),
     ({"column": "created_at", "op": "contains", "now": "-30d"}, "time_operator"),
     ({"column": "created_at", "op": "gte", "now": "yesterday"}, "time_offset"),
+    ({"column": "amount", "op": "eq", "arg": "amount", "type": "number"}, "condition_type"),
+    ({"column": "amount", "op": "gte", "arg": "amount", "type": "decimal"}, "condition_type_operator"),
+    ({"column": "amount", "op": "eq", "value": "not-a-number", "type": "decimal"}, "condition_decimal_value"),
 ])
 def test_column_conditions_reject_invalid_shapes_and_targets(condition, code):
     rules = _rules({"source": "billing", "match": [condition]})
@@ -177,6 +180,7 @@ def test_column_conditions_reject_invalid_shapes_and_targets(condition, code):
     {"column": "created_at", "op": "gte", "now": 0},
     {"column": "created_at", "op": "lt", "now": "+1h"},
     {"column": "owner", "value": None},
+    {"column": "amount", "op": "eq", "value": "86.40", "type": "decimal"},
 ])
 def test_valid_target_variants_are_accepted(condition):
     rules = _rules({"source": "billing", "match": [condition]})

tests/test_source.py

@@ -54,6 +54,14 @@ def test_match_another_arg(conn):
     assert conn.ground("A", chk, {}, {"amount": 500}).grounded is False
 
 
+def test_exact_decimal_match_another_arg(conn):
+    chk = {"query": "SELECT bal FROM accts WHERE id=:value",
+           "match": [{"column": "bal", "op": "eq", "arg": "amount", "type": "decimal"}]}
+    assert conn.ground("A", chk, {}, {"amount": 100}).grounded is True
+    assert conn.ground("A", chk, {}, {"amount": "100.00"}).grounded is True
+    assert conn.ground("A", chk, {}, {"amount": 100.001}).grounded is False
+
+
 def test_match_now(conn):
     q = "SELECT exp FROM accts WHERE id=:value"
     # exp is +10 days: later than now, earlier than now+30d