crtx-verifier 0.1.0

//! Producer-supplied evidence input for the trusted-evidence reducer.
//!
//! This is the data the CLI loads before invoking [`crate::verify`]. Per ADR
//! 0041 §"Pure trust path", the verifier does not read filesystems or the
//! network — every byte the trust decision rests on is here.

use cortex_core::{AuthorityClass, ClaimCeiling, ClaimProofState, RuntimeMode};
use serde::{Deserialize, Serialize};

/// Class of evidence being witnessed. Decides which witness composition is
/// required for `FullChainVerified`.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, Deserialize)]
#[serde(rename_all = "snake_case")]
pub enum EvidenceKind {
    /// `cortex release readiness` evidence.
    ReleaseReadiness,
    /// `cortex compliance evidence` evidence.
    ComplianceEvidence,
}

impl EvidenceKind {
    /// Stable lowercase wire string for this kind.
    #[must_use]
    pub const fn wire_str(self) -> &'static str {
        match self {
            Self::ReleaseReadiness => "release_readiness",
            Self::ComplianceEvidence => "compliance_evidence",
        }
    }
}

/// Source reference the producer declared on the evidence input (e.g.
/// `signed://fixture/evidence`, `https://...`). The verifier does not fetch
/// these; they are recorded for reporting.
pub type SourceRef = String;

/// Producer-supplied evidence input. Built by the CLI from the evidence file /
/// inline JSON and the producer's declared `evidence_blake3`.
///
/// Every witness's `asserted_subject_blake3` MUST equal
/// [`EvidenceInput::evidence_blake3`].
#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
pub struct EvidenceInput {
    /// Which surface (release-readiness or compliance-evidence) requested this
    /// reduction.
    pub kind: EvidenceKind,
    /// Lowercase BLAKE3 hex of the exact producer-supplied evidence bytes.
    pub evidence_blake3: String,
    /// Runtime mode the producer declares it ran under.
    pub runtime_mode: RuntimeMode,
    /// Authority class declared on the evidence input.
    pub authority_class: AuthorityClass,
    /// Proof closure state declared by the producer.
    pub proof_state: ClaimProofState,
    /// Producer-requested ceiling. The verifier still clamps to the weakest
    /// supporting signal per `cortex_core::effective_ceiling`.
    pub requested_ceiling: ClaimCeiling,
    /// Declared source refs (informational; not used to make a trust decision).
    pub source_refs: Vec<SourceRef>,
    /// Marker that this evidence path is advisory-only by construction
    /// (e.g. `dev` runtime mode, `pre_v2_backup` evidence kind). When set, the
    /// verifier short-circuits to `verifier.witness.tier_insufficient` per
    /// ADR 0041 acceptance criterion §132 — local/dev/pre-v2 stay advisory even
    /// with witnesses present.
    pub advisory_only: bool,
}

impl EvidenceInput {
    /// True when the evidence path is advisory-only by construction.
    #[must_use]
    pub const fn is_advisory_only(&self) -> bool {
        self.advisory_only
    }
}