use std::{
ffi::OsString,
io::Write as _,
process::{Command, ExitCode},
};
use crate::CliError;
const BEFORE: &str = "Correct. Robust. Fast. Portable.\nOwn the change: name the behavior, authoritative machine, pipe contract, and affected invariants.\nMake invalid states unrepresentable; preserve exact refusals and rejected ownership.\nNeed a runtime collection? Start with WarpTable; alternatives need a specific, principled reason.\nRun the repository's applicable evidence sequence: architecture, targeted behavior and owning-package checks, portability, core coverage, mutations, and required proofs. Performance claims need measurements.\nNo evidence diaries or generated reports in source control. Add no code comments; make types, names, and structure carry the explanation.\n";
const AFTER: &str = "\nEvidence command succeeded. Design review follows; this is not an additional proof or a claim that omitted checks ran.\n1. Who owns each truth? Are derived views clearly distinguished from authority?\n2. Which invalid states are structurally impossible? Does construction require every correctness-bearing choice?\n3. Do core, pipes, and switchboards stay no_std, with physical work confined to wiring?\n4. Are pipe contracts precise and matches exhaustive, preserving refusals and unconsumed ownership?\n5. Is independent work fanout and dependent work a continuation, without hidden sequencing in the circuit?\n6. Do runtime collections use WarpTable, or have a specific reason not to? Are capacities, saturation, cancellation, deadlines, and shutdown explicit and bounded?\n7. Does backpressure preserve ownership and enable batching without changing semantic guarantees?\n8. Can a fresh author understand the names, type parameters, and callsites without our conversation?\n9. Which allocations, copies, scans, syscalls, and retained buffers remain? What measurement could falsify the performance claim?\n10. Do initialization and every mutating entry point preserve the invariant? Are proof bounds, portability limits, and evidence gaps stated honestly?\nIf review changes the candidate, rerun affected evidence before reviewing again. Keep the answers in the candidate discussion; no new report files are required.\n";
pub(crate) fn parse(
mut arguments: impl Iterator<Item = OsString>,
) -> Result<Vec<OsString>, CliError> {
if arguments.next().as_deref() != Some(std::ffi::OsStr::new("--")) {
return Err(CliError::new(
"usage: pipecircuit review -- <repository-evidence-command> [arguments...]",
));
}
let command: Vec<_> = arguments.collect();
if command.is_empty() {
return Err(CliError::new(
"review requires a repository evidence command; no checks were run",
));
}
Ok(command)
}
pub(crate) fn execute(
arguments: Vec<OsString>,
) -> Result<(String, ExitCode), Box<dyn std::error::Error>> {
let (program, arguments) = arguments
.split_first()
.ok_or_else(|| CliError::new("missing evidence command"))?;
{
let mut output = std::io::stderr().lock();
write!(output, "{BEFORE}\nRunning evidence: {program:?}")?;
for argument in arguments {
write!(output, " {argument:?}")?;
}
writeln!(output)?;
output.flush()?;
}
let status = Command::new(program).args(arguments).status()?;
if status.success() {
Ok((AFTER.into(), ExitCode::SUCCESS))
} else {
let code = status
.code()
.and_then(|code| u8::try_from(code).ok())
.filter(|code| *code != 0)
.unwrap_or(1);
Ok((
format!(
"Evidence command failed ({status}). Resolve the failure or explicitly establish baseline debt; the post-evidence design review has not been triggered.\n"
),
ExitCode::from(code),
))
}
}