frame-host 0.4.0

//! The authority gate in front of the bytecode-push door (ruling C3).
//!
//! AT THIS COMMIT THERE IS NO DOOR: no code path anywhere in frame-host
//! can activate staged bytes. This gate and its test land FIRST — the
//! red-first pin the tear ruled — so that when the door is built (behind
//! this gate, dev-wiring only), the production refusal is already law,
//! not a property the door happens to have.
//!
//! Production is not "dev minus a flag": a production host has no path
//! from a stage request to an activation, and the test pins that shape by
//! asserting the gate refuses BEFORE anything downstream could run.

use super::{NodeMode, StageRefusal};

/// Refuses staged activation on any host that was not started in dev
/// mode. Every handler of `DevRequest::StageAndActivate` MUST pass this
/// gate before touching anything — the refusal happens with zero node
/// operations performed.
///
/// # Errors
///
/// [`StageRefusal::NotADevNode`] for a production host.
pub fn require_dev_node(mode: NodeMode) -> Result<(), StageRefusal> {
    match mode {
        NodeMode::Dev => Ok(()),
        NodeMode::Production => Err(StageRefusal::NotADevNode),
    }
}

#[cfg(test)]
mod tests {
    use super::require_dev_node;
    use crate::dev::{NodeMode, StageRefusal};

    /// The C3 pin: a production host refuses staged activation, typed,
    /// with nothing downstream ever reached. This test predates the door
    /// itself — at the commit that introduces it, no activation code
    /// exists in this crate — and it must stay green forever after the
    /// door is built behind the gate.
    #[test]
    fn production_host_refuses_staged_activation() {
        assert_eq!(
            require_dev_node(NodeMode::Production),
            Err(StageRefusal::NotADevNode)
        );
    }

    /// The gate admits exactly the dev-started host.
    #[test]
    fn dev_host_passes_the_gate() {
        assert_eq!(require_dev_node(NodeMode::Dev), Ok(()));
    }
}