saddle-runtime 0.2.0

//! Deterministic, non-authoritative Runtime input for the 0.2 machine manifest.
//!
//! This boundary emits only Runtime-owned build-static capacity and termination
//! work facts. It carries no global root, generation, signature, receipt, or
//! deployment calibration.

use std::sync::atomic::{AtomicBool, Ordering};

use serde::Deserialize;
use serde::Serialize;
use sha2::{Digest, Sha256};

use crate::{
    capacity_leaf::runtime_capacity_component_proof,
    termination_service::runtime_component_work_proof,
};

const SCHEMA: &str = "saddle-0.2-runtime-production-fact/1";
const DOMAIN: &str = "runtime";
const MANIFEST_LEAF: &str = "runtime";
const CAPACITY_COMMITMENT: &str = "runtime_capacity";
const MANIFEST_FACT: &str = "runtime_work_identity";
const WORK_COMMITMENT: &str = "runtime_work";
const APPROVED_SOURCE: &str = "da64568f31bfacd38f6c0807588dd2cc59c258fe";
const APPROVED_WHOLE: &[u8] = include_bytes!("approved-inputs/candidate-fact-whole.json");
const APPROVED_PERMIT: &[u8] = include_bytes!("approved-inputs/permit.json");
static RUNTIME_CANDIDATE_CONSUMED: AtomicBool = AtomicBool::new(false);

/// The sole Runtime-produced input for its 0.2 component facts.
///
/// The private, non-Clone owner is machine input only and has no authority
/// before the complete manifest is verified.
///
/// ```compile_fail
/// use saddle_runtime::production_fact::RuntimeProductionFactInput;
/// let _ = RuntimeProductionFactInput {};
/// ```
///
/// ```compile_fail
/// use saddle_runtime::production_fact::RuntimeProductionFactInput;
/// fn duplicate(input: RuntimeProductionFactInput) { let _ = input.clone(); }
/// ```
#[doc(hidden)]
pub struct RuntimeProductionFactInput {
    document: RuntimeProductionFactDocument,
}

/// The exact approved semantic whole and acceptance permit for RT-02.
///
/// ```compile_fail
/// use saddle_runtime::production_fact::RuntimeSourceCandidateInput;
/// fn duplicate(input: RuntimeSourceCandidateInput) { let _ = input.clone(); }
/// ```
#[doc(hidden)]
pub struct RuntimeSourceCandidateInput {
    whole: &'static [u8],
    permit: &'static [u8],
}

/// Runtime's opaque, one-shot result in the approved source candidate.
///
/// ```compile_fail
/// use saddle_runtime::production_fact::VerifiedRuntimeSourceCandidateOwner;
/// let _ = VerifiedRuntimeSourceCandidateOwner {};
/// ```
///
/// ```compile_fail
/// use saddle_runtime::production_fact::VerifiedRuntimeSourceCandidateOwner;
/// fn duplicate(owner: VerifiedRuntimeSourceCandidateOwner) { let _ = owner.clone(); }
/// ```
#[doc(hidden)]
pub struct VerifiedRuntimeSourceCandidateOwner {
    fact: RuntimeProductionFactInput,
    candidate: RuntimeSourceCandidateInput,
}

/// Rejection restores the exact original Runtime fact and candidate input.
#[doc(hidden)]
pub struct RuntimeSourceCandidateRejection {
    fact: RuntimeProductionFactInput,
    candidate: RuntimeSourceCandidateInput,
}

impl core::fmt::Debug for RuntimeSourceCandidateRejection {
    fn fmt(&self, formatter: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
        formatter.write_str("RuntimeSourceCandidateRejection(<recoverable>)")
    }
}

impl RuntimeSourceCandidateRejection {
    #[doc(hidden)]
    pub fn into_inputs(self) -> (RuntimeProductionFactInput, RuntimeSourceCandidateInput) {
        (self.fact, self.candidate)
    }
}

#[derive(Debug)]
#[doc(hidden)]
pub struct RuntimeProductionFactError(serde_json::Error);

impl core::fmt::Display for RuntimeProductionFactError {
    fn fmt(&self, formatter: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
        formatter.write_str("Runtime production fact serialization failed")
    }
}

impl std::error::Error for RuntimeProductionFactError {
    fn source(&self) -> Option<&(dyn std::error::Error + 'static)> {
        Some(&self.0)
    }
}

impl RuntimeProductionFactInput {
    #[doc(hidden)]
    pub fn into_canonical_json(self) -> Result<Box<[u8]>, RuntimeProductionFactError> {
        serde_json::to_vec(&self.document)
            .map(Vec::into_boxed_slice)
            .map_err(RuntimeProductionFactError)
    }
}

/// Produces fixed Runtime facts without accepting caller-supplied values.
#[doc(hidden)]
pub fn runtime_production_fact_input() -> RuntimeProductionFactInput {
    let capacity = runtime_capacity_component_proof();
    let (support_limits, fixed_topology) = capacity.production_shape();
    let work = runtime_component_work_proof();
    let (work_domain, delivery_bounds) = work.production_bounds();
    RuntimeProductionFactInput {
        document: RuntimeProductionFactDocument {
            schema: SCHEMA,
            domain: DOMAIN,
            authority: false,
            capacity: RuntimeCapacityFact {
                manifest_leaf: MANIFEST_LEAF,
                commitment: CAPACITY_COMMITMENT,
                component_proof_identity: hex_identity(capacity.identity()),
                target: "x86_64-unknown-linux-gnu",
                rust_version: [1, 85, 0],
                tokio_version: [1, 53, 1],
                support_limits,
                fixed_topology,
            },
            termination: RuntimeTerminationFact {
                manifest_fact: MANIFEST_FACT,
                commitment: WORK_COMMITMENT,
                work_identity: hex_identity(work.identity()),
                work_domain,
                delivery_bounds,
            },
        },
    }
}

/// Returns the sole source-controlled whole/permit pair approved for RT-02.
#[doc(hidden)]
pub fn runtime_source_candidate_input() -> RuntimeSourceCandidateInput {
    RuntimeSourceCandidateInput {
        whole: APPROVED_WHOLE,
        permit: APPROVED_PERMIT,
    }
}

/// Binds the real Runtime fact to the exact approved source candidate.
///
/// Every fallible check precedes the one-shot commit. Foreign, drifted, or
/// replayed input is rejected with both original linear inputs intact.
#[doc(hidden)]
#[allow(clippy::result_large_err)]
pub fn bind_runtime_source_candidate(
    fact: RuntimeProductionFactInput,
    candidate: RuntimeSourceCandidateInput,
) -> Result<VerifiedRuntimeSourceCandidateOwner, RuntimeSourceCandidateRejection> {
    if !matches_approved_candidate(&fact, &candidate)
        || RUNTIME_CANDIDATE_CONSUMED
            .compare_exchange(false, true, Ordering::AcqRel, Ordering::Acquire)
            .is_err()
    {
        return Err(RuntimeSourceCandidateRejection { fact, candidate });
    }
    Ok(VerifiedRuntimeSourceCandidateOwner { fact, candidate })
}

/// Restores the exact successful inputs before the Transport commit boundary.
///
/// Consuming the opaque owner releases its one-shot claim, so only the returned
/// original pair can attempt the same binding again.
#[doc(hidden)]
pub fn rollback_runtime_source_candidate(
    owner: VerifiedRuntimeSourceCandidateOwner,
) -> (RuntimeProductionFactInput, RuntimeSourceCandidateInput) {
    let VerifiedRuntimeSourceCandidateOwner { fact, candidate } = owner;
    RUNTIME_CANDIDATE_CONSUMED.store(false, Ordering::Release);
    (fact, candidate)
}

fn matches_approved_candidate(
    fact: &RuntimeProductionFactInput,
    candidate: &RuntimeSourceCandidateInput,
) -> bool {
    if candidate.whole.as_ptr() != APPROVED_WHOLE.as_ptr()
        || candidate.whole.len() != APPROVED_WHOLE.len()
        || candidate.permit.as_ptr() != APPROVED_PERMIT.as_ptr()
        || candidate.permit.len() != APPROVED_PERMIT.len()
    {
        return false;
    }
    let Ok(fact_bytes) = serde_json::to_vec(&fact.document) else {
        return false;
    };
    let Ok(whole) = serde_json::from_slice::<CandidateWhole>(candidate.whole) else {
        return false;
    };
    let Ok(permit) = serde_json::from_slice::<ValidationPermit>(candidate.permit) else {
        return false;
    };
    whole.schema == "saddle-0.2-semantic-fact-whole-candidate/1"
        && !whole.authority
        && whole.projection.domain_sha256.runtime == hex_sha256(&fact_bytes)
        && whole
            .projection
            .termination_work_identities
            .iter()
            .any(|identity| identity == &fact.document.termination.work_identity)
        && permit.schema == "saddle-0.2-golden-c8-source-validation-permit/1"
        && permit.authority_scope == "golden-c8-listener-preclosure-only"
        && permit.source_candidate_identity == APPROVED_SOURCE
        && permit.candidate_fact_whole_identity == hex_sha256(candidate.whole)
        && permit.candidate_semantic_identity == whole.semantic_identity
        && permit.single_use
        && permit.minimum_terminal_stage == "listener"
        && !permit.signing_authority
        && !permit.enterprise_production_authority
        && !permit.rust_skill_artifact_combination_authority
        && !permit.component_production_wiring_authority
        && !permit.publish_authority
        && !permit.release_authority
}

fn hex_sha256(bytes: &[u8]) -> String {
    hex_identity(Sha256::digest(bytes).into())
}

#[derive(Deserialize)]
struct CandidateWhole {
    schema: String,
    authority: bool,
    semantic_identity: String,
    projection: CandidateProjection,
}

#[derive(Deserialize)]
struct CandidateProjection {
    domain_sha256: CandidateDomainDigests,
    termination_work_identities: Vec<String>,
}

#[derive(Deserialize)]
struct CandidateDomainDigests {
    runtime: String,
}

#[derive(Deserialize)]
struct ValidationPermit {
    schema: String,
    authority_scope: String,
    source_candidate_identity: String,
    candidate_fact_whole_identity: String,
    candidate_semantic_identity: String,
    single_use: bool,
    minimum_terminal_stage: String,
    signing_authority: bool,
    enterprise_production_authority: bool,
    rust_skill_artifact_combination_authority: bool,
    component_production_wiring_authority: bool,
    publish_authority: bool,
    release_authority: bool,
}

#[derive(Serialize)]
struct RuntimeProductionFactDocument {
    schema: &'static str,
    domain: &'static str,
    authority: bool,
    capacity: RuntimeCapacityFact,
    termination: RuntimeTerminationFact,
}

#[derive(Serialize)]
struct RuntimeCapacityFact {
    manifest_leaf: &'static str,
    commitment: &'static str,
    component_proof_identity: String,
    target: &'static str,
    rust_version: [u16; 3],
    tokio_version: [u16; 3],
    support_limits: [usize; 4],
    fixed_topology: [usize; 3],
}

#[derive(Serialize)]
struct RuntimeTerminationFact {
    manifest_fact: &'static str,
    commitment: &'static str,
    work_identity: String,
    work_domain: [u16; 3],
    delivery_bounds: [u64; 4],
}

fn hex_identity(identity: [u8; 32]) -> String {
    use core::fmt::Write as _;
    let mut encoded = String::with_capacity(64);
    for byte in identity {
        write!(&mut encoded, "{byte:02x}").expect("writing to String cannot fail");
    }
    encoded
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn production_fact_is_canonical_stable_and_non_authoritative() {
        let first = runtime_production_fact_input()
            .into_canonical_json()
            .unwrap();
        let second = runtime_production_fact_input()
            .into_canonical_json()
            .unwrap();
        assert_eq!(first, second);
        assert!(!first.contains(&b'\n'));
        let document: serde_json::Value = serde_json::from_slice(&first).unwrap();
        assert_eq!(document["authority"], false);
        assert_eq!(
            document["capacity"]["support_limits"],
            serde_json::json!([8, 128, 128, 64])
        );
        assert_eq!(document["termination"]["work_identity"], "d7".repeat(32));
        assert!(document.get("root_identity").is_none());
        assert!(document.get("owner_generation").is_none());
    }

    #[test]
    fn approved_candidate_is_exact_recoverable_and_one_shot() {
        let mut foreign_fact = runtime_production_fact_input();
        foreign_fact.document.termination.delivery_bounds[0] -= 1;
        let rejection =
            match bind_runtime_source_candidate(foreign_fact, runtime_source_candidate_input()) {
                Err(rejection) => rejection,
                Ok(_) => panic!("drifted Runtime fact is rejected"),
            };
        let (fact, candidate) = rejection.into_inputs();
        let rejection = match bind_runtime_source_candidate(fact, candidate) {
            Err(rejection) => rejection,
            Ok(_) => panic!("the same drifted inputs remain rejected"),
        };
        let (_fact, _candidate) = rejection.into_inputs();

        let foreign_whole = Box::leak(APPROVED_WHOLE.to_vec().into_boxed_slice());
        let candidate = RuntimeSourceCandidateInput {
            whole: foreign_whole,
            permit: APPROVED_PERMIT,
        };
        let foreign_whole_pointer = candidate.whole.as_ptr();
        let foreign_permit_pointer = candidate.permit.as_ptr();
        let rejection =
            match bind_runtime_source_candidate(runtime_production_fact_input(), candidate) {
                Err(rejection) => rejection,
                Ok(_) => panic!("a byte-identical but foreign whole is rejected"),
            };
        let (fact, foreign_candidate) = rejection.into_inputs();
        assert_eq!(foreign_candidate.whole.as_ptr(), foreign_whole_pointer);
        assert_eq!(foreign_candidate.permit.as_ptr(), foreign_permit_pointer);

        let foreign_permit = Box::leak(APPROVED_PERMIT.to_vec().into_boxed_slice());
        let candidate = RuntimeSourceCandidateInput {
            whole: APPROVED_WHOLE,
            permit: foreign_permit,
        };
        let foreign_whole_pointer = candidate.whole.as_ptr();
        let foreign_permit_pointer = candidate.permit.as_ptr();
        let rejection =
            match bind_runtime_source_candidate(runtime_production_fact_input(), candidate) {
                Err(rejection) => rejection,
                Ok(_) => panic!("a byte-identical but foreign permit is rejected"),
            };
        let (_fact, foreign_candidate) = rejection.into_inputs();
        assert_eq!(foreign_candidate.whole.as_ptr(), foreign_whole_pointer);
        assert_eq!(foreign_candidate.permit.as_ptr(), foreign_permit_pointer);

        let candidate = runtime_source_candidate_input();
        let fact_bytes = serde_json::to_vec(&fact.document).unwrap();
        let whole: CandidateWhole = serde_json::from_slice(candidate.whole).unwrap();
        let permit: ValidationPermit = serde_json::from_slice(candidate.permit).unwrap();
        assert_eq!(
            whole.projection.domain_sha256.runtime,
            hex_sha256(&fact_bytes)
        );
        assert!(
            whole
                .projection
                .termination_work_identities
                .contains(&fact.document.termination.work_identity)
        );
        assert_eq!(permit.source_candidate_identity, APPROVED_SOURCE);
        assert_eq!(
            permit.candidate_fact_whole_identity,
            hex_sha256(candidate.whole)
        );
        assert_eq!(permit.candidate_semantic_identity, whole.semantic_identity);
        assert!(matches_approved_candidate(&fact, &candidate));
        let owner = match bind_runtime_source_candidate(fact, candidate) {
            Ok(owner) => owner,
            Err(_) => panic!("the original Runtime fact pairs with the approved candidate"),
        };

        let replay_candidate = runtime_source_candidate_input();
        let replay_whole_pointer = replay_candidate.whole.as_ptr();
        let replay_permit_pointer = replay_candidate.permit.as_ptr();
        let replay =
            bind_runtime_source_candidate(runtime_production_fact_input(), replay_candidate)
                .err()
                .expect("approved candidate is one-shot");
        let (replay_fact, replay_candidate) = replay.into_inputs();
        assert_eq!(
            hex_sha256(&serde_json::to_vec(&replay_fact.document).unwrap()),
            whole.projection.domain_sha256.runtime
        );
        assert_eq!(replay_candidate.whole.as_ptr(), replay_whole_pointer);
        assert_eq!(replay_candidate.permit.as_ptr(), replay_permit_pointer);

        let (fact, candidate) = rollback_runtime_source_candidate(owner);
        let _owner = match bind_runtime_source_candidate(fact, candidate) {
            Ok(owner) => owner,
            Err(_) => panic!("the exact rolled-back pair can retry successfully"),
        };

        let rejection = match bind_runtime_source_candidate(
            runtime_production_fact_input(),
            runtime_source_candidate_input(),
        ) {
            Err(rejection) => rejection,
            Ok(_) => panic!("approved candidate is one-shot"),
        };
        let (_fact, _candidate) = rejection.into_inputs();
    }
}