vyre-conform 0.1.0

//! Read-only accessors for sealed conformance certificate types.

use std::collections::BTreeMap;

use super::{
    Certificate, CertificateLevels, CertificateStrength, ConformanceLevel, CoverageMetrics,
    EngineResult, EngineStatus, OpOutcome, OpResult, TrackReport, Violation,
};
use crate::spec::law::LawViolation;
use crate::spec::types::ParityFailure;

impl Violation {
    /// Create a structured conformance violation.
    #[must_use]
    #[inline]
    pub(crate) fn new(
        op_id: String,
        law: String,
        backend: String,
        reference_output: Vec<u8>,
        backend_output: Vec<u8>,
        message: String,
    ) -> Self {
        Self {
            op_id,
            law,
            backend,
            reference_output,
            backend_output,
            message,
        }
    }

    /// Operation identifier being certified when the violation occurred.
    #[must_use]
    #[inline]
    pub fn op_id(&self) -> &str {
        &self.op_id
    }

    /// Algebraic law or conformance rule that was violated.
    #[must_use]
    #[inline]
    pub fn law(&self) -> &str {
        &self.law
    }

    /// Backend identifier that produced the violating output.
    #[must_use]
    #[inline]
    pub fn backend(&self) -> &str {
        &self.backend
    }

    /// CPU reference bytes for the failing case.
    #[must_use]
    #[inline]
    pub fn reference_output(&self) -> &[u8] {
        &self.reference_output
    }

    /// Backend output bytes for the failing case.
    #[must_use]
    #[inline]
    pub fn backend_output(&self) -> &[u8] {
        &self.backend_output
    }

    /// Actionable remediation message.
    #[must_use]
    #[inline]
    pub fn message(&self) -> &str {
        &self.message
    }
}

impl Certificate {
    #[must_use]
    #[inline]
    pub(crate) fn new(
        backend_name: String,
        backend_version: String,
        spec_version: u32,
        level: CertificateLevels,
        timestamp: String,
        monotonic_sequence: u64,
        strength: CertificateStrength,
        witness_count: u64,
        witness_count_by_op: BTreeMap<String, u64>,
        proof_status: String,
        integer_track: TrackReport,
        float_track: Option<TrackReport>,
        approximate_track: Option<TrackReport>,
        ops: Vec<OpResult>,
        unsupported_ops: Vec<String>,
        engines: Vec<EngineResult>,
        registry_hash: [u8; 32],
        coverage: CoverageMetrics,
    ) -> Self {
        let certificate_hash = certificate_hash_for(
            &backend_name,
            &backend_version,
            spec_version,
            &timestamp,
            monotonic_sequence,
            &registry_hash,
        );
        Self {
            backend_name,
            backend_version,
            spec_version,
            level,
            timestamp,
            monotonic_sequence,
            certificate_hash,
            strength,
            witness_count,
            witness_count_by_op,
            proof_status,
            integer_track,
            float_track,
            approximate_track,
            ops,
            unsupported_ops,
            engines,
            registry_hash,
            coverage,
        }
    }

    /// Stable certificate identifier.
    #[must_use]
    #[inline]
    pub fn id(&self) -> &[u8; 32] {
        &self.certificate_hash
    }

    /// Backend identifier that produced this certificate.
    #[must_use]
    #[inline]
    pub fn backend_id(&self) -> &str {
        &self.backend_name
    }

    /// Spec registry hash covered by this certificate.
    #[must_use]
    #[inline]
    pub fn spec_hash(&self) -> &[u8; 32] {
        &self.registry_hash
    }

    /// Deterministic certificate digest.
    #[must_use]
    #[inline]
    pub fn cert_hash(&self) -> &[u8; 32] {
        &self.certificate_hash
    }

    /// Backend implementation name that produced this certificate.
    #[must_use]
    #[inline]
    pub fn backend_name(&self) -> &str {
        &self.backend_name
    }

    /// Backend implementation version that produced this certificate.
    #[must_use]
    #[inline]
    pub fn backend_version(&self) -> &str {
        &self.backend_version
    }

    /// Highest operation spec version included in this certificate run.
    #[must_use]
    #[inline]
    pub fn spec_version(&self) -> u32 {
        self.spec_version
    }

    /// Claimed conformance levels after all operation, law, and engine gates.
    #[must_use]
    #[inline]
    pub fn level(&self) -> CertificateLevels {
        self.level
    }

    /// UTC issuance timestamp for this certificate.
    #[must_use]
    #[inline]
    pub fn timestamp(&self) -> &str {
        &self.timestamp
    }

    /// Process-local monotonic issuance sequence.
    #[must_use]
    #[inline]
    pub fn monotonic_sequence(&self) -> u64 {
        self.monotonic_sequence
    }

    /// Deterministic certificate digest.
    #[must_use]
    #[inline]
    pub fn certificate_hash(&self) -> &[u8; 32] {
        &self.certificate_hash
    }

    /// Requested certificate strength for this run.
    #[must_use]
    #[inline]
    pub fn strength(&self) -> CertificateStrength {
        self.strength
    }

    /// Declared witness budget for the requested certificate strength.
    #[must_use]
    #[inline]
    pub fn witness_count(&self) -> u64 {
        self.witness_count
    }

    /// Actual per-operation law witness counts retained in the certificate.
    #[must_use]
    #[inline]
    pub fn witness_count_by_op(&self) -> &BTreeMap<String, u64> {
        &self.witness_count_by_op
    }

    /// Human-readable proof status derived from the certificate strength.
    #[must_use]
    #[inline]
    pub fn proof_status(&self) -> &str {
        &self.proof_status
    }

    /// Integer-track certification report.
    #[must_use]
    #[inline]
    pub fn integer_track(&self) -> &TrackReport {
        &self.integer_track
    }

    /// Float-track certification report when float operations were present.
    #[must_use]
    #[inline]
    pub fn float_track(&self) -> &Option<TrackReport> {
        &self.float_track
    }

    /// Approximate-track certification report when approximate operations were present.
    #[must_use]
    #[inline]
    pub fn approximate_track(&self) -> &Option<TrackReport> {
        &self.approximate_track
    }

    /// Per-operation certification results.
    #[must_use]
    #[inline]
    pub fn ops(&self) -> &[OpResult] {
        &self.ops
    }

    /// Operation identifiers that the backend explicitly reported unsupported.
    #[must_use]
    #[inline]
    pub fn unsupported_ops(&self) -> &[String] {
        &self.unsupported_ops
    }

    /// Engine invariant harness results that gate claimed certificate levels.
    #[must_use]
    #[inline]
    pub fn engines(&self) -> &[EngineResult] {
        &self.engines
    }

    /// Blake3 registry fingerprint for the exact certified operation specs.
    #[must_use]
    #[inline]
    pub fn registry_hash(&self) -> &[u8; 32] {
        &self.registry_hash
    }

    /// Aggregate operation and law coverage metrics.
    #[must_use]
    #[inline]
    pub fn coverage(&self) -> &CoverageMetrics {
        &self.coverage
    }
}

impl OpResult {
    /// Operation identifier for this result.
    #[must_use]
    #[inline]
    pub fn id(&self) -> &str {
        &self.id
    }

    /// Operation archetype used for track reporting.
    #[must_use]
    #[inline]
    pub fn archetype(&self) -> &str {
        &self.archetype
    }

    /// Final per-operation outcome.
    #[must_use]
    #[inline]
    pub fn outcome(&self) -> OpOutcome {
        self.outcome
    }

    /// Whether every generated parity case matched the CPU reference.
    #[must_use]
    #[inline]
    pub fn parity_passed(&self) -> bool {
        self.parity_passed
    }

    /// Declared laws verified with at least one executed case and no violation.
    #[must_use]
    #[inline]
    pub fn laws_verified(&self) -> &[String] {
        &self.laws_verified
    }

    /// Concrete law violations recorded for this operation.
    #[must_use]
    #[inline]
    pub fn laws_failed(&self) -> &[LawViolation] {
        &self.laws_failed
    }

    /// Retained parity failures for forensic replay.
    #[must_use]
    #[inline]
    pub fn parity_failures(&self) -> &[ParityFailure] {
        &self.parity_failures
    }

    /// Total parity and law cases evaluated for this operation.
    #[must_use]
    #[inline]
    pub fn cases_tested(&self) -> u64 {
        self.cases_tested
    }

    /// Actual law witness cases tested for this operation, capped by strength.
    #[must_use]
    #[inline]
    pub fn witness_count(&self) -> u64 {
        self.witness_count
    }
}

impl TrackReport {
    /// Claimed conformance level for this track, or none if any gate failed.
    #[must_use]
    #[inline]
    pub fn level(&self) -> Option<ConformanceLevel> {
        self.level
    }

    /// Operation results included in this track.
    #[must_use]
    #[inline]
    pub fn ops(&self) -> &[OpResult] {
        &self.ops
    }

    /// Unsupported operation identifiers included in this track.
    #[must_use]
    #[inline]
    pub fn unsupported_ops(&self) -> &[String] {
        &self.unsupported_ops
    }

    /// Track-local coverage metrics.
    #[must_use]
    #[inline]
    pub fn coverage(&self) -> &CoverageMetrics {
        &self.coverage
    }
}

impl EngineResult {
    /// Engine harness identifier.
    #[must_use]
    #[inline]
    pub fn id(&self) -> &str {
        &self.id
    }

    /// Aggregate pass/fail status for this engine harness.
    #[must_use]
    #[inline]
    pub fn status(&self) -> EngineStatus {
        self.status
    }

    /// Engine invariants verified by this harness.
    #[must_use]
    #[inline]
    pub fn invariants_verified(&self) -> &[String] {
        &self.invariants_verified
    }

    /// Engine invariant failure diagnostics.
    #[must_use]
    #[inline]
    pub fn invariants_failed(&self) -> &[String] {
        &self.invariants_failed
    }

    /// Number of invariant cases evaluated by this harness.
    #[must_use]
    #[inline]
    pub fn cases_tested(&self) -> u64 {
        self.cases_tested
    }
}

fn certificate_hash_for(
    backend_name: &str,
    backend_version: &str,
    spec_version: u32,
    timestamp: &str,
    monotonic_sequence: u64,
    registry_hash: &[u8; 32],
) -> [u8; 32] {
    let mut hasher = blake3::Hasher::new();
    hasher.update(b"vyre-conform.certificate.v1");
    hash_bytes(&mut hasher, backend_name.as_bytes());
    hash_bytes(&mut hasher, backend_version.as_bytes());
    hasher.update(&spec_version.to_le_bytes());
    hash_bytes(&mut hasher, timestamp.as_bytes());
    hasher.update(&monotonic_sequence.to_le_bytes());
    hasher.update(registry_hash);
    *hasher.finalize().as_bytes()
}

fn hash_bytes(hasher: &mut blake3::Hasher, bytes: &[u8]) {
    hasher.update(&(bytes.len() as u64).to_le_bytes());
    hasher.update(bytes);
}