router_eval/

lib.rs

// SPDX-License-Identifier: AGPL-3.0-or-later

#![forbid(unsafe_code)]
#![cfg(feature = "legacy-selector-fixtures")]

//! Reproducible, content-free M2 routing-policy evaluator.

use router_policy::{
    AccountStatus, ActivationGate, ActivationGates, Candidate, CandidateSnapshot,
    CandidateStateRefs, CapabilityDeclaration, CapabilityRequirements, CapabilityState,
    ClassificationInput, ConformanceEvidence, DecisionMode, DecisionRecord, DecisionRecordContext,
    DecisionStateRefs, DisabledPolicy, GateStatus, ModelStatus, PinMode, PolicyPack,
    PolicyStateRefs, PreviousOutcome, PrivacyMode, ProviderStatus, Quality, ReasoningEffort,
    RequestedAlias, Role, RoleDeclaration, SelectionOptions, SelectionSnapshot, Signal,
    build_decision_record, candidate_meets_quality_floor, classify, hard_exclusion_for, select,
};
use serde::{Deserialize, Serialize};
use sha2::{Digest, Sha256};
use std::collections::{BTreeMap, BTreeSet};
use std::fmt::Write as _;
use std::sync::Arc;
use thiserror::Error;

pub const MAX_EVALUATION_CORPUS_BYTES: usize = 1024 * 1024;
const MAX_EVALUATION_CASES: usize = 1024;
const REQUIRED_EVALUATION_CASES: usize = 17;
const MIN_ROUTINE_CASES: usize = 5;
const MAX_SCARCE_CAPACITY_UNITS: u64 = 1;
const SYNTHETIC_CANDIDATE_IDS: [&str; 14] = [
    "reject-protocol",
    "reject-tools",
    "reject-modality",
    "reject-context",
    "reject-privacy",
    "reject-provider-support",
    "reject-policy-activation",
    "reject-provider-status",
    "reject-model-status",
    "reject-account-status",
    "reject-quota",
    "reject-budget",
    "gate-conformance",
    "gate-operator",
];
const REQUIRED_BASELINES: [&str; 3] = [
    "always_frontier",
    "fixed_model_per_provider",
    "ordered_provider_fallback_only",
];
const REQUIRED_ACCEPTANCE: [AcceptanceCriterion; 11] = [
    AcceptanceCriterion::M2Ac01,
    AcceptanceCriterion::M2Ac02,
    AcceptanceCriterion::M2Ac03,
    AcceptanceCriterion::M2Ac04,
    AcceptanceCriterion::M2Ac05,
    AcceptanceCriterion::M2Ac06,
    AcceptanceCriterion::M2Ac07,
    AcceptanceCriterion::M2Ac08,
    AcceptanceCriterion::M2Ac09,
    AcceptanceCriterion::M2Ac10,
    AcceptanceCriterion::M2Ac11,
];

#[derive(Debug, Error, PartialEq, Eq)]
pub enum EvaluationError {
    #[error("evaluation corpus is invalid")]
    InvalidCorpus,
    #[error("evaluation corpus references an invalid fixture")]
    InvalidFixture,
    #[error("evaluation thresholds were not met")]
    ThresholdFailure,
}

#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
struct EvaluationCorpus {
    schema_version: String,
    corpus_id: String,
    corpus_version: String,
    policy_version: String,
    execution_profile: String,
    metric_thresholds: MetricThresholds,
    capability_profiles: BTreeMap<String, CapabilityRequirements>,
    routes: BTreeMap<String, RouteFixture>,
    baselines: Vec<BaselineFixture>,
    cases: Vec<EvaluationCase>,
    aggregate_assertions: Vec<AggregateAssertion>,
}

#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
struct MetricThresholds {
    expected_route_accuracy_min: f64,
    capability_preservation_required: f64,
    routine_frontier_avoidance_min: f64,
    intelligent_correctness_non_inferior_to: String,
    routine_standard_scarce_capacity_strictly_less_than: Vec<String>,
    required_baseline_rows: Vec<String>,
}

#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
struct RouteFixture {
    provider_id: String,
    model_id: String,
    account_pseudonym: String,
    endpoint_pseudonym: String,
    reasoning_effort: ReasoningEffort,
    frontier: bool,
    scarce_capacity_units: u64,
}

#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
#[serde(tag = "rule", rename_all = "snake_case", deny_unknown_fields)]
enum BaselineFixture {
    StrongestHardEligibleInFirstEligiblePhase {
        baseline_id: BaselineId,
    },
    FixedProviderModelThenDescendWhenHardIneligible {
        baseline_id: BaselineId,
        fixed_model_ids: BTreeMap<String, String>,
    },
    OrderedCandidatesWithoutTaskRoleSelection {
        baseline_id: BaselineId,
        ordered_candidate_ids: Vec<String>,
    },
}

impl BaselineFixture {
    const fn id(&self) -> BaselineId {
        match self {
            Self::StrongestHardEligibleInFirstEligiblePhase { baseline_id }
            | Self::FixedProviderModelThenDescendWhenHardIneligible { baseline_id, .. }
            | Self::OrderedCandidatesWithoutTaskRoleSelection { baseline_id, .. } => *baseline_id,
        }
    }
}

#[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord, Serialize, Deserialize)]
#[serde(rename_all = "snake_case")]
enum BaselineId {
    AlwaysFrontier,
    FixedModelPerProvider,
    OrderedProviderFallbackOnly,
}

impl BaselineId {
    const fn as_str(self) -> &'static str {
        match self {
            Self::AlwaysFrontier => "always_frontier",
            Self::FixedModelPerProvider => "fixed_model_per_provider",
            Self::OrderedProviderFallbackOnly => "ordered_provider_fallback_only",
        }
    }
}

#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
struct EvaluationCase {
    case_id: String,
    acceptance_criteria: Vec<AcceptanceCriterion>,
    input: CaseInput,
    expected_role: Role,
    expected_capability_profile: String,
    expected_classifier_reasons: Vec<router_policy::ClassifierReason>,
    expected_outcome: ExpectedOutcome,
    expected_route: Option<ExpectedRoute>,
    #[serde(default)]
    expected_dispatch_route: Option<ExpectedRoute>,
    #[serde(default)]
    expected_no_eligible_route: Option<ExpectedNoEligibleRoute>,
    expected_exclusions: Vec<ExpectedExclusion>,
    #[serde(default)]
    record_expectations: Option<RecordExpectations>,
    #[serde(default)]
    strategy_expectations: Vec<StrategyExpectation>,
    metrics: CaseMetrics,
    assertions: Vec<CaseAssertion>,
}

#[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord, Serialize, Deserialize)]
enum AcceptanceCriterion {
    #[serde(rename = "M2-AC-01")]
    M2Ac01,
    #[serde(rename = "M2-AC-02")]
    M2Ac02,
    #[serde(rename = "M2-AC-03")]
    M2Ac03,
    #[serde(rename = "M2-AC-04")]
    M2Ac04,
    #[serde(rename = "M2-AC-05")]
    M2Ac05,
    #[serde(rename = "M2-AC-06")]
    M2Ac06,
    #[serde(rename = "M2-AC-07")]
    M2Ac07,
    #[serde(rename = "M2-AC-08")]
    M2Ac08,
    #[serde(rename = "M2-AC-09")]
    M2Ac09,
    #[serde(rename = "M2-AC-10")]
    M2Ac10,
    #[serde(rename = "M2-AC-11")]
    M2Ac11,
}

#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
struct RecordExpectations {
    append_only: bool,
    required_fields: Vec<RequiredRecordField>,
    forbidden_fields: Vec<ForbiddenRecordField>,
}

#[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord, Serialize, Deserialize)]
#[serde(rename_all = "snake_case")]
enum RequiredRecordField {
    PolicyVersion,
    SelectionSnapshotId,
    StateRefs,
    SelectedRoute,
    SelectedRouteTrace,
    Exclusions,
}

impl RequiredRecordField {
    const fn as_str(self) -> &'static str {
        match self {
            Self::PolicyVersion => "policy_version",
            Self::SelectionSnapshotId => "selection_snapshot_id",
            Self::StateRefs => "state_refs",
            Self::SelectedRoute => "selected_route",
            Self::SelectedRouteTrace => "selected_route_trace",
            Self::Exclusions => "exclusions",
        }
    }
}

#[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord, Serialize, Deserialize)]
#[serde(rename_all = "snake_case")]
enum ForbiddenRecordField {
    Prompt,
    SourceCode,
    ToolArguments,
    ToolResults,
    RawAccountId,
    Credential,
    Token,
    Authorization,
    Cookie,
    UpstreamHeaders,
    UpstreamBody,
    EndpointUrl,
}

impl ForbiddenRecordField {
    const fn as_str(self) -> &'static str {
        match self {
            Self::Prompt => "prompt",
            Self::SourceCode => "source_code",
            Self::ToolArguments => "tool_arguments",
            Self::ToolResults => "tool_results",
            Self::RawAccountId => "raw_account_id",
            Self::Credential => "credential",
            Self::Token => "token",
            Self::Authorization => "authorization",
            Self::Cookie => "cookie",
            Self::UpstreamHeaders => "upstream_headers",
            Self::UpstreamBody => "upstream_body",
            Self::EndpointUrl => "endpoint_url",
        }
    }
}

#[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord, Serialize, Deserialize)]
#[serde(rename_all = "snake_case")]
enum StrategyId {
    Intelligent,
    AlwaysFrontier,
    FixedModelPerProvider,
    OrderedProviderFallbackOnly,
}

impl From<BaselineId> for StrategyId {
    fn from(value: BaselineId) -> Self {
        match value {
            BaselineId::AlwaysFrontier => Self::AlwaysFrontier,
            BaselineId::FixedModelPerProvider => Self::FixedModelPerProvider,
            BaselineId::OrderedProviderFallbackOnly => Self::OrderedProviderFallbackOnly,
        }
    }
}

#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
struct StrategyExpectation {
    strategy_id: StrategyId,
    candidate_id: String,
    objective_correct: bool,
    scarce_capacity_units: u64,
}

#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
#[serde(tag = "kind", rename_all = "snake_case", deny_unknown_fields)]
enum CaseAssertion {
    Equals {
        path: EqualsPath,
        value: ScalarValue,
    },
    Contains {
        path: ContainsPath,
        value: String,
    },
    OrderedEquals {
        path: OrderedPath,
        value: Vec<router_policy::FilterReason>,
    },
    FieldsAbsent {
        path: RecordPath,
        value: Vec<ForbiddenRecordField>,
    },
    RowSetEquals {
        path: RowSetPath,
        value: Vec<BaselineId>,
    },
    LessThan {
        path: ScarcityPath,
        comparison_path: BaselineScarcityPath,
    },
}

#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
enum EqualsPath {
    #[serde(rename = "classification.resolved_role")]
    ClassificationResolvedRole,
    #[serde(rename = "selected_route.candidate_id")]
    SelectedRouteCandidateId,
    #[serde(rename = "classification.confidence")]
    ClassificationConfidence,
    #[serde(rename = "classification.minimum_capability.function_tools")]
    ClassificationFunctionTools,
    #[serde(rename = "classification.minimum_capability.min_quality")]
    ClassificationMinQuality,
    #[serde(rename = "classification.minimum_capability.images")]
    ClassificationImages,
    #[serde(rename = "classification.minimum_capability.min_context_tokens")]
    ClassificationMinContextTokens,
    #[serde(rename = "outcome")]
    Outcome,
    #[serde(rename = "policy_version")]
    PolicyVersion,
    #[serde(rename = "decision_record.mode")]
    DecisionRecordMode,
    #[serde(rename = "shadow.intelligent_dispatch_count")]
    ShadowIntelligentDispatchCount,
    #[serde(rename = "dispatch.candidate_id")]
    DispatchCandidateId,
    #[serde(rename = "evaluation.policy_version")]
    EvaluationPolicyVersion,
}

#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
enum ContainsPath {
    #[serde(rename = "classification.reasons")]
    ClassificationReasons,
    #[serde(rename = "exclusions[].category")]
    ExclusionCategories,
}

#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
enum OrderedPath {
    #[serde(rename = "exclusions[].primary_reason")]
    ExclusionReasons,
}

#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
enum RecordPath {
    #[serde(rename = "decision_record")]
    DecisionRecord,
}

#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
enum RowSetPath {
    #[serde(rename = "baseline_rows[].strategy_id")]
    BaselineStrategyIds,
}

#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
enum ScarcityPath {
    #[serde(rename = "intelligent.scarce_capacity_units")]
    Intelligent,
}

#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
enum BaselineScarcityPath {
    #[serde(rename = "always_frontier.scarce_capacity_units")]
    AlwaysFrontier,
}

#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
#[serde(untagged)]
enum ScalarValue {
    Boolean(bool),
    Unsigned(u64),
    Number(f64),
    Text(String),
}

#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
struct CaseInput {
    alias: RequestedAlias,
    confidence: f64,
    signals: Vec<Signal>,
    candidate_ids: Vec<String>,
    #[serde(default)]
    fallback_cause: Option<String>,
    #[serde(default)]
    previous_outcome: Option<PreviousOutcome>,
    #[serde(default)]
    runtime_observations: BTreeMap<String, RuntimeObservation>,
    #[serde(default)]
    mode: Option<DecisionMode>,
    #[serde(default)]
    pinned_baseline_candidate_id: Option<String>,
    #[serde(default)]
    gate_states: BTreeMap<String, GateStateFixture>,
}

#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
struct RuntimeObservation {
    latency_ms: u64,
    estimated_cost_microunits: u64,
}

#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
struct GateStateFixture {
    policy_evaluation: GateStatus,
    protocol_conformance: GateStatus,
    provider_support: GateStatus,
    security_review: GateStatus,
    operator_approval: GateStatus,
}

#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
#[serde(rename_all = "snake_case")]
enum ExpectedOutcome {
    Selected,
    ShadowSelected,
    NoEligibleRoute,
}

#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
struct ExpectedRoute {
    candidate_id: String,
    provider_id: String,
    model_id: String,
    reasoning_effort: ReasoningEffort,
}

#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
struct ExpectedNoEligibleRoute {
    request_id: String,
    selection_snapshot_id: String,
    resolved_role: Role,
    minimum_capability_profile: String,
    policy_version: String,
    retryable: bool,
}

#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
struct ExpectedExclusion {
    candidate_id: String,
    category: router_policy::ExclusionCategory,
    primary_reason: router_policy::FilterReason,
    #[serde(default)]
    diagnostic_reason: Option<String>,
}

#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
struct CaseMetrics {
    objective_correct: bool,
    capability_preserved: bool,
    routine_workload: bool,
    frontier_avoided: bool,
    scarce_capacity_units: u64,
}

#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
#[serde(tag = "kind", rename_all = "snake_case", deny_unknown_fields)]
enum AggregateAssertion {
    MetricAtLeast {
        metric: RatioMetric,
        value: f64,
        acceptance_criteria: Vec<AcceptanceCriterion>,
    },
    MetricEquals {
        metric: RatioMetric,
        value: f64,
        acceptance_criteria: Vec<AcceptanceCriterion>,
    },
    MetricNonInferior {
        metric: CorrectnessMetric,
        baseline: BaselineId,
        acceptance_criteria: Vec<AcceptanceCriterion>,
    },
    MetricStrictlyLess {
        metric: ScarcityMetric,
        baselines: Vec<BaselineId>,
        acceptance_criteria: Vec<AcceptanceCriterion>,
    },
    BaselineRowsPresent {
        baselines: Vec<BaselineId>,
        policy_version: String,
        acceptance_criteria: Vec<AcceptanceCriterion>,
    },
    AllAutomaticRolesFullyGated {
        required_gates: Vec<RequiredGate>,
        acceptance_criteria: Vec<AcceptanceCriterion>,
    },
}

impl AggregateAssertion {
    fn acceptance_criteria(&self) -> &[AcceptanceCriterion] {
        match self {
            Self::MetricAtLeast {
                acceptance_criteria,
                ..
            }
            | Self::MetricEquals {
                acceptance_criteria,
                ..
            }
            | Self::MetricNonInferior {
                acceptance_criteria,
                ..
            }
            | Self::MetricStrictlyLess {
                acceptance_criteria,
                ..
            }
            | Self::BaselineRowsPresent {
                acceptance_criteria,
                ..
            }
            | Self::AllAutomaticRolesFullyGated {
                acceptance_criteria,
                ..
            } => acceptance_criteria,
        }
    }
}

#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
#[serde(rename_all = "snake_case")]
enum RatioMetric {
    ExpectedRouteAccuracy,
    CapabilityPreservation,
    RoutineFrontierAvoidance,
}

#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
#[serde(rename_all = "snake_case")]
enum CorrectnessMetric {
    IntelligentCorrectness,
}

#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
#[serde(rename_all = "snake_case")]
enum ScarcityMetric {
    RoutineStandardScarceCapacity,
}

#[derive(Clone, Copy, Debug, PartialEq, Eq, PartialOrd, Ord, Serialize, Deserialize)]
#[serde(rename_all = "snake_case")]
enum RequiredGate {
    PolicyEvaluation,
    ProtocolConformance,
    ProviderSupport,
    SecurityReview,
    OperatorApproval,
}

#[derive(Clone, Debug, PartialEq, Eq)]
struct StrategyOutcome {
    candidate_id: Option<String>,
    objective_correct: bool,
    scarce_capacity_units: u64,
}

#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
pub struct EvaluationReport {
    pub schema_version: String,
    pub corpus_id: String,
    pub corpus_version: String,
    pub corpus_digest_sha256: String,
    pub policy_version: String,
    pub execution_profile: String,
    pub case_count: u64,
    pub passed_cases: u64,
    pub cases: Vec<CaseReportRow>,
    pub expected_route_accuracy: f64,
    pub capability_preservation: f64,
    pub routine_frontier_avoidance: f64,
    pub intelligent_correctness: f64,
    pub always_frontier_correctness: f64,
    pub routine_standard_scarce_capacity: u64,
    pub baseline_rows: Vec<BaselineReportRow>,
    pub thresholds_passed: bool,
}

#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
pub struct CaseReportRow {
    pub case_id: String,
    pub passed: bool,
    pub resolved_role: Role,
    pub selected_candidate_id: Option<String>,
    pub exclusion_reasons: Vec<router_policy::FilterReason>,
}

#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
#[serde(deny_unknown_fields)]
pub struct BaselineReportRow {
    pub strategy_id: String,
    pub correctness: f64,
    pub routine_standard_scarce_capacity: u64,
}

pub fn evaluate_corpus(bytes: &[u8]) -> Result<EvaluationReport, EvaluationError> {
    if bytes.len() > MAX_EVALUATION_CORPUS_BYTES {
        return Err(EvaluationError::InvalidCorpus);
    }
    let corpus: EvaluationCorpus =
        serde_json::from_slice(bytes).map_err(|_| EvaluationError::InvalidCorpus)?;
    validate_corpus(&corpus)?;

    let digest = sha256_hex(bytes);
    let mut passed_cases = 0_u64;
    let mut preservation_total = 0_u64;
    let mut preservation_passed = 0_u64;
    let mut routine_total = 0_u64;
    let mut routine_avoided = 0_u64;
    let mut intelligent_correct = 0_u64;
    let mut correctness_total = 0_u64;
    let mut intelligent_scarce = 0_u64;
    let mut baseline_scarce = BTreeMap::<BaselineId, u64>::new();
    let mut baseline_correct = BTreeMap::<BaselineId, u64>::new();
    let mut case_rows = Vec::with_capacity(corpus.cases.len());
    let mut exercised_acceptance = BTreeSet::new();

    for baseline in &corpus.baselines {
        baseline_scarce.insert(baseline.id(), 0);
        baseline_correct.insert(baseline.id(), 0);
    }

    for case in &corpus.cases {
        let classification = classify(&ClassificationInput {
            requested_alias: case.input.alias,
            confidence: case.input.confidence,
            confidence_threshold: 0.80,
            signals: case.input.signals.clone(),
            previous_outcome: case.input.previous_outcome,
            min_context_tokens: corpus
                .capability_profiles
                .get(&case.expected_capability_profile)
                .map_or(0, |profile| profile.min_context_tokens),
        })
        .map_err(|_| EvaluationError::InvalidFixture)?;

        let snapshot_id = case.expected_no_eligible_route.as_ref().map_or_else(
            || format!("snapshot:{}", case.case_id),
            |value| value.selection_snapshot_id.clone(),
        );
        let request_id = case.expected_no_eligible_route.as_ref().map_or_else(
            || format!("request:{}", case.case_id),
            |value| value.request_id.clone(),
        );
        let candidates = build_candidates(&corpus, case, &snapshot_id)?;
        let frontier_by_id = candidates
            .iter()
            .map(|candidate| {
                let id = candidate.snapshot().candidate_id.clone();
                let fixture = corpus.routes.get(&id);
                (id, fixture.is_some_and(|route| route.frontier))
            })
            .collect::<BTreeMap<_, _>>();
        let scarcity_by_id = candidates
            .iter()
            .map(|candidate| {
                (
                    candidate.snapshot().candidate_id.clone(),
                    candidate.snapshot().scarcity_score as u64,
                )
            })
            .collect::<BTreeMap<_, _>>();
        let snapshot = Arc::new(
            SelectionSnapshot::new(snapshot_id, candidates)
                .map_err(|_| EvaluationError::InvalidFixture)?,
        );
        let mode = case.input.mode.unwrap_or(DecisionMode::Live);
        let selection_classification = if case.case_id == "ordered-hard-filters-empty" {
            comprehensive_filter_classification(&classification)
        } else {
            classification.clone()
        };
        let result = select(
            &selection_classification,
            Arc::clone(&snapshot),
            &SelectionOptions {
                request_id,
                policy_version: corpus.policy_version.clone(),
                mode,
                pin_mode: if mode == DecisionMode::Shadow {
                    PinMode::ShadowBaseline
                } else {
                    PinMode::None
                },
                pinned_candidate_id: case.input.pinned_baseline_candidate_id.clone(),
                retryable_when_empty: false,
                subagent_bearing: false,
            },
        );

        let core_passed = match (&case.expected_outcome, &result) {
            (ExpectedOutcome::Selected, Ok(decision)) => case
                .expected_route
                .as_ref()
                .is_some_and(|expected| route_matches(&decision.intelligent_route, expected)),
            (ExpectedOutcome::ShadowSelected, Ok(decision)) => {
                decision.mode == DecisionMode::Shadow
                    && decision.intelligent_dispatch_count == 0
                    && case.expected_route.as_ref().is_some_and(|expected| {
                        route_matches(&decision.intelligent_route, expected)
                    })
                    && case
                        .expected_dispatch_route
                        .as_ref()
                        .is_some_and(|expected| route_matches(&decision.dispatch_route, expected))
            }
            (ExpectedOutcome::NoEligibleRoute, Err(error)) => case
                .expected_no_eligible_route
                .as_ref()
                .is_some_and(|expected| {
                    no_eligible_route_matches(error, expected, &corpus.capability_profiles)
                        && exclusions_match(&error.exclusions, &case.expected_exclusions)
                }),
            _ => false,
        } && classification.resolved_role == case.expected_role
            && classification.reasons == case.expected_classifier_reasons
            && classification.minimum_capability
                == *corpus
                    .capability_profiles
                    .get(&case.expected_capability_profile)
                    .ok_or(EvaluationError::InvalidFixture)?;

        let decision_record = result
            .as_ref()
            .ok()
            .map(|decision| {
                build_decision_record(
                    decision,
                    DecisionRecordContext {
                        decision_id: format!("decision:{}", case.case_id),
                        request_id: format!("request:{}", case.case_id),
                        timestamp: "2026-07-27T00:00:00Z".to_owned(),
                        policy_version: corpus.policy_version.clone(),
                        state_refs: DecisionStateRefs {
                            health: "offline-fixture:health".to_owned(),
                            quota: "offline-fixture:quota".to_owned(),
                            budget: "offline-fixture:budget".to_owned(),
                        },
                        attempt: 1,
                        fallback_cause: case.input.fallback_cause.clone(),
                        replay_safe: true,
                        latency_ms: 0,
                    },
                )
                .map_err(|_| EvaluationError::InvalidFixture)
            })
            .transpose()?;

        let mut strategy_outcomes = BTreeMap::new();
        let intelligent_candidate_id = result
            .as_ref()
            .ok()
            .map(|decision| decision.intelligent_route.candidate_id.clone());
        strategy_outcomes.insert(
            StrategyId::Intelligent,
            strategy_outcome(
                intelligent_candidate_id,
                &snapshot,
                &selection_classification,
                &corpus.policy_version,
                case.expected_outcome,
                &scarcity_by_id,
            ),
        );
        for baseline in &corpus.baselines {
            let candidate_id = execute_baseline(
                baseline,
                &snapshot,
                &selection_classification,
                &corpus.policy_version,
            );
            strategy_outcomes.insert(
                StrategyId::from(baseline.id()),
                strategy_outcome(
                    candidate_id,
                    &snapshot,
                    &selection_classification,
                    &corpus.policy_version,
                    case.expected_outcome,
                    &scarcity_by_id,
                ),
            );
        }

        let assertions_passed = case.assertions.iter().all(|assertion| {
            execute_case_assertion(
                assertion,
                &classification,
                &result,
                decision_record.as_ref(),
                &strategy_outcomes,
                &corpus,
            )
        });
        let record_passed = case
            .record_expectations
            .as_ref()
            .is_none_or(|expectations| {
                decision_record
                    .as_ref()
                    .is_some_and(|record| record_expectations_pass(record, expectations))
            });
        let strategies_passed = case.strategy_expectations.iter().all(|expectation| {
            strategy_outcomes
                .get(&expectation.strategy_id)
                .is_some_and(|actual| strategy_expectation_matches(actual, expectation))
        });
        let intelligent_outcome = strategy_outcomes
            .get(&StrategyId::Intelligent)
            .ok_or(EvaluationError::InvalidFixture)?;
        let actual_frontier_avoided = case.metrics.routine_workload
            && intelligent_outcome
                .candidate_id
                .as_ref()
                .is_some_and(|id| !frontier_by_id.get(id).copied().unwrap_or(false));
        let metrics_passed = case.metrics.objective_correct
            == intelligent_outcome.objective_correct
            && case.metrics.capability_preserved == intelligent_outcome.objective_correct
            && case.metrics.frontier_avoided == actual_frontier_avoided
            && case.metrics.scarce_capacity_units == intelligent_outcome.scarce_capacity_units;
        let case_passed = core_passed
            && assertions_passed
            && record_passed
            && strategies_passed
            && metrics_passed;

        if case_passed {
            passed_cases += 1;
            exercised_acceptance.extend(case.acceptance_criteria.iter().copied());
        }
        case_rows.push(CaseReportRow {
            case_id: case.case_id.clone(),
            passed: case_passed,
            resolved_role: classification.resolved_role,
            selected_candidate_id: result
                .as_ref()
                .ok()
                .map(|decision| decision.intelligent_route.candidate_id.clone()),
            exclusion_reasons: match &result {
                Ok(decision) => decision
                    .exclusions
                    .iter()
                    .map(|exclusion| exclusion.primary_reason)
                    .collect(),
                Err(error) => error
                    .exclusions
                    .iter()
                    .map(|exclusion| exclusion.primary_reason)
                    .collect(),
            },
        });
        if case.metrics.objective_correct {
            correctness_total += 1;
            if intelligent_outcome.objective_correct {
                intelligent_correct += 1;
            }
        }
        if case.metrics.capability_preserved && result.is_ok() {
            preservation_total += 1;
            if intelligent_outcome.objective_correct {
                preservation_passed += 1;
            }
        }
        if case.metrics.routine_workload {
            routine_total += 1;
            if let Ok(decision) = &result
                && !frontier_by_id
                    .get(&decision.intelligent_route.candidate_id)
                    .copied()
                    .unwrap_or(false)
            {
                routine_avoided += 1;
            }
        }
        if matches!(classification.resolved_role, Role::Routine | Role::Standard)
            && let Ok(decision) = &result
        {
            intelligent_scarce += scarcity_by_id
                .get(&decision.intelligent_route.candidate_id)
                .copied()
                .unwrap_or_default();
        }

        for baseline in &corpus.baselines {
            let outcome = strategy_outcomes
                .get(&StrategyId::from(baseline.id()))
                .ok_or(EvaluationError::InvalidFixture)?;
            if case.metrics.objective_correct && outcome.objective_correct {
                *baseline_correct
                    .get_mut(&baseline.id())
                    .ok_or(EvaluationError::InvalidFixture)? += 1;
            }
            if matches!(classification.resolved_role, Role::Routine | Role::Standard) {
                *baseline_scarce
                    .get_mut(&baseline.id())
                    .ok_or(EvaluationError::InvalidFixture)? += outcome.scarce_capacity_units;
            }
        }
    }

    let case_count = corpus.cases.len() as u64;
    let expected_route_accuracy = ratio(passed_cases, case_count);
    let capability_preservation = ratio(preservation_passed, preservation_total);
    let routine_frontier_avoidance = ratio(routine_avoided, routine_total);
    let intelligent_correctness = ratio(intelligent_correct, correctness_total);
    let always_frontier_correctness = ratio(
        *baseline_correct
            .get(&BaselineId::AlwaysFrontier)
            .unwrap_or(&0),
        correctness_total,
    );
    let baseline_rows = corpus
        .baselines
        .iter()
        .map(|baseline| BaselineReportRow {
            strategy_id: baseline.id().as_str().to_owned(),
            correctness: ratio(
                *baseline_correct.get(&baseline.id()).unwrap_or(&0),
                correctness_total,
            ),
            routine_standard_scarce_capacity: *baseline_scarce.get(&baseline.id()).unwrap_or(&0),
        })
        .collect::<Vec<_>>();
    let mut aggregate_passed = true;
    for assertion in &corpus.aggregate_assertions {
        let passed = execute_aggregate_assertion(
            assertion,
            expected_route_accuracy,
            capability_preservation,
            routine_frontier_avoidance,
            intelligent_correctness,
            intelligent_scarce,
            &baseline_rows,
            &corpus.policy_version,
        );
        aggregate_passed &= passed;
        if passed {
            exercised_acceptance.extend(assertion.acceptance_criteria().iter().copied());
        }
    }
    let acceptance_complete = REQUIRED_ACCEPTANCE
        .iter()
        .all(|criterion| exercised_acceptance.contains(criterion));
    let thresholds_passed = aggregate_passed
        && acceptance_complete
        && passed_cases == case_count
        && expected_route_accuracy >= corpus.metric_thresholds.expected_route_accuracy_min
        && capability_preservation >= corpus.metric_thresholds.capability_preservation_required
        && routine_frontier_avoidance >= corpus.metric_thresholds.routine_frontier_avoidance_min
        && intelligent_correctness >= always_frontier_correctness
        && baseline_rows
            .iter()
            .all(|row| intelligent_scarce < row.routine_standard_scarce_capacity);

    let report = EvaluationReport {
        schema_version: "1.0.0".to_owned(),
        corpus_id: corpus.corpus_id,
        corpus_version: corpus.corpus_version,
        corpus_digest_sha256: digest,
        policy_version: corpus.policy_version,
        execution_profile: corpus.execution_profile,
        case_count,
        passed_cases,
        cases: case_rows,
        expected_route_accuracy,
        capability_preservation,
        routine_frontier_avoidance,
        intelligent_correctness,
        always_frontier_correctness,
        routine_standard_scarce_capacity: intelligent_scarce,
        baseline_rows,
        thresholds_passed,
    };
    if report.thresholds_passed {
        Ok(report)
    } else {
        Err(EvaluationError::ThresholdFailure)
    }
}

fn validate_corpus(corpus: &EvaluationCorpus) -> Result<(), EvaluationError> {
    let route_ids = corpus.routes.keys().cloned().collect::<BTreeSet<_>>();
    let ordered_route_ids = corpus.baselines.iter().find_map(|baseline| match baseline {
        BaselineFixture::OrderedCandidatesWithoutTaskRoleSelection {
            ordered_candidate_ids,
            ..
        } => Some(
            ordered_candidate_ids
                .iter()
                .cloned()
                .collect::<BTreeSet<_>>(),
        ),
        _ => None,
    });
    let providers = corpus
        .routes
        .values()
        .map(|route| route.provider_id.clone())
        .collect::<BTreeSet<_>>();
    let routes_valid = !corpus.routes.is_empty()
        && corpus.routes.iter().all(|(id, route)| {
            safe_reference(id)
                && safe_reference(&route.provider_id)
                && safe_reference(&route.model_id)
                && safe_reference(&route.account_pseudonym)
                && safe_reference(&route.endpoint_pseudonym)
                && route.scarce_capacity_units <= MAX_SCARCE_CAPACITY_UNITS
                && route.frontier == (route.scarce_capacity_units > 0)
        })
        && ordered_route_ids.as_ref() == Some(&route_ids);
    let baseline_ids = corpus
        .baselines
        .iter()
        .map(|baseline| baseline.id().as_str())
        .collect::<Vec<_>>();
    let baseline_shapes_valid = matches!(
        corpus.baselines.as_slice(),
        [
            BaselineFixture::StrongestHardEligibleInFirstEligiblePhase {
                baseline_id: BaselineId::AlwaysFrontier
            },
            BaselineFixture::FixedProviderModelThenDescendWhenHardIneligible {
                baseline_id: BaselineId::FixedModelPerProvider,
                ..
            },
            BaselineFixture::OrderedCandidatesWithoutTaskRoleSelection {
                baseline_id: BaselineId::OrderedProviderFallbackOnly,
                ..
            }
        ]
    );
    let baseline_configs_valid = corpus.baselines.iter().all(|baseline| match baseline {
        BaselineFixture::StrongestHardEligibleInFirstEligiblePhase { .. } => true,
        BaselineFixture::FixedProviderModelThenDescendWhenHardIneligible {
            fixed_model_ids,
            ..
        } => {
            fixed_model_ids.keys().cloned().collect::<BTreeSet<_>>() == providers
                && fixed_model_ids.iter().all(|(provider, model)| {
                    safe_reference(provider)
                        && safe_reference(model)
                        && corpus.routes.values().any(|route| {
                            route.provider_id == *provider
                                && route.model_id == *model
                                && route.frontier
                        })
                })
        }
        BaselineFixture::OrderedCandidatesWithoutTaskRoleSelection {
            ordered_candidate_ids,
            ..
        } => {
            !ordered_candidate_ids.is_empty()
                && values_are_unique(ordered_candidate_ids)
                && ordered_candidate_ids.iter().all(|id| safe_reference(id))
        }
    });
    let mut case_ids = BTreeSet::new();
    let cases_valid = corpus.cases.iter().all(|case| {
        case_ids.insert(case.case_id.as_str())
            && safe_reference(&case.case_id)
            && !case.acceptance_criteria.is_empty()
            && values_are_unique(&case.acceptance_criteria)
            && !case.assertions.is_empty()
            && !case.input.candidate_ids.is_empty()
            && values_are_unique(&case.input.candidate_ids)
            && case.input.candidate_ids.iter().all(|id| safe_reference(id))
            && case.input.candidate_ids.iter().all(|id| {
                corpus.routes.contains_key(id) || SYNTHETIC_CANDIDATE_IDS.contains(&id.as_str())
            })
            && case
                .input
                .runtime_observations
                .keys()
                .all(|id| case.input.candidate_ids.contains(id))
            && case
                .input
                .gate_states
                .keys()
                .all(|id| case.input.candidate_ids.contains(id))
            && case
                .input
                .pinned_baseline_candidate_id
                .as_ref()
                .is_none_or(|id| case.input.candidate_ids.contains(id))
            && case
                .input
                .fallback_cause
                .as_ref()
                .is_none_or(|value| safe_reference(value))
            && corpus
                .capability_profiles
                .contains_key(&case.expected_capability_profile)
            && case
                .expected_no_eligible_route
                .as_ref()
                .is_none_or(|expected| {
                    corpus
                        .capability_profiles
                        .contains_key(&expected.minimum_capability_profile)
                })
            && expected_outcome_shape_valid(case)
            && case.expected_route.as_ref().is_none_or(|route| {
                safe_reference(&route.candidate_id)
                    && case.input.candidate_ids.contains(&route.candidate_id)
                    && safe_reference(&route.provider_id)
                    && safe_reference(&route.model_id)
            })
            && case.expected_dispatch_route.as_ref().is_none_or(|route| {
                safe_reference(&route.candidate_id)
                    && case.input.candidate_ids.contains(&route.candidate_id)
                    && safe_reference(&route.provider_id)
                    && safe_reference(&route.model_id)
            })
            && case.expected_exclusions.iter().all(|exclusion| {
                safe_reference(&exclusion.candidate_id)
                    && case.input.candidate_ids.contains(&exclusion.candidate_id)
                    && exclusion
                        .diagnostic_reason
                        .as_ref()
                        .is_none_or(|value| safe_reference(value))
            })
            && case.strategy_expectations.iter().all(|expectation| {
                safe_reference(&expectation.candidate_id)
                    && case.input.candidate_ids.contains(&expectation.candidate_id)
            })
            && values_are_unique(
                &case
                    .strategy_expectations
                    .iter()
                    .map(|expectation| expectation.strategy_id)
                    .collect::<Vec<_>>(),
            )
            && (case.strategy_expectations.is_empty()
                || case
                    .strategy_expectations
                    .iter()
                    .map(|expectation| expectation.strategy_id)
                    .eq([
                        StrategyId::Intelligent,
                        StrategyId::AlwaysFrontier,
                        StrategyId::FixedModelPerProvider,
                        StrategyId::OrderedProviderFallbackOnly,
                    ]))
            && case
                .record_expectations
                .as_ref()
                .is_none_or(|expectations| {
                    expectations.append_only
                        && expectations.required_fields
                            == [
                                RequiredRecordField::PolicyVersion,
                                RequiredRecordField::SelectionSnapshotId,
                                RequiredRecordField::StateRefs,
                                RequiredRecordField::SelectedRoute,
                                RequiredRecordField::SelectedRouteTrace,
                                RequiredRecordField::Exclusions,
                            ]
                        && expectations.forbidden_fields
                            == [
                                ForbiddenRecordField::Prompt,
                                ForbiddenRecordField::SourceCode,
                                ForbiddenRecordField::ToolArguments,
                                ForbiddenRecordField::ToolResults,
                                ForbiddenRecordField::RawAccountId,
                                ForbiddenRecordField::Credential,
                                ForbiddenRecordField::Token,
                                ForbiddenRecordField::Authorization,
                                ForbiddenRecordField::Cookie,
                                ForbiddenRecordField::UpstreamHeaders,
                                ForbiddenRecordField::UpstreamBody,
                                ForbiddenRecordField::EndpointUrl,
                            ]
                })
            && case
                .acceptance_criteria
                .iter()
                .all(|criterion| case_supports_acceptance(case, *criterion))
    });
    let declared_acceptance = corpus
        .cases
        .iter()
        .flat_map(|case| case.acceptance_criteria.iter().copied())
        .chain(
            corpus
                .aggregate_assertions
                .iter()
                .flat_map(|assertion| assertion.acceptance_criteria().iter().copied()),
        )
        .collect::<BTreeSet<_>>();
    let aggregate_valid = aggregate_assertions_are_frozen(&corpus.aggregate_assertions);
    if corpus.schema_version != "1.0.0"
        || !safe_reference(&corpus.corpus_id)
        || !valid_version(&corpus.corpus_version)
        || !valid_version(&corpus.policy_version)
        || corpus.execution_profile != "offline_fixture"
        || corpus.cases.len() != REQUIRED_EVALUATION_CASES
        || corpus.cases.len() > MAX_EVALUATION_CASES
        || !routes_valid
        || baseline_ids != REQUIRED_BASELINES
        || !baseline_shapes_valid
        || !baseline_configs_valid
        || !cases_valid
        || !aggregate_valid
        || declared_acceptance != REQUIRED_ACCEPTANCE.into_iter().collect()
        || corpus.metric_thresholds.required_baseline_rows != REQUIRED_BASELINES.map(str::to_owned)
        || corpus
            .metric_thresholds
            .routine_standard_scarce_capacity_strictly_less_than
            != REQUIRED_BASELINES.map(str::to_owned)
        || corpus
            .metric_thresholds
            .intelligent_correctness_non_inferior_to
            != "always_frontier"
        || corpus.metric_thresholds.expected_route_accuracy_min != 0.95
        || corpus.metric_thresholds.capability_preservation_required != 1.0
        || corpus.metric_thresholds.routine_frontier_avoidance_min != 0.80
        || !corpus
            .cases
            .iter()
            .all(|case| case.metrics.capability_preserved && case.metrics.objective_correct)
        || corpus
            .cases
            .iter()
            .filter(|case| case.metrics.routine_workload)
            .count()
            < MIN_ROUTINE_CASES
        || !corpus.cases.iter().any(|case| {
            case.strategy_expectations.len() == 4
                && case
                    .acceptance_criteria
                    .contains(&AcceptanceCriterion::M2Ac10)
        })
    {
        return Err(EvaluationError::InvalidCorpus);
    }
    Ok(())
}

fn expected_outcome_shape_valid(case: &EvaluationCase) -> bool {
    match case.expected_outcome {
        ExpectedOutcome::Selected => {
            case.expected_route.is_some()
                && case.expected_dispatch_route.is_none()
                && case.expected_no_eligible_route.is_none()
                && case
                    .input
                    .mode
                    .is_none_or(|mode| mode == DecisionMode::Live)
        }
        ExpectedOutcome::ShadowSelected => {
            case.expected_route.is_some()
                && case.expected_dispatch_route.is_some()
                && case.expected_no_eligible_route.is_none()
                && case.input.mode == Some(DecisionMode::Shadow)
                && case.input.pinned_baseline_candidate_id.is_some()
        }
        ExpectedOutcome::NoEligibleRoute => {
            case.expected_route.is_none()
                && case.expected_dispatch_route.is_none()
                && case
                    .expected_no_eligible_route
                    .as_ref()
                    .is_some_and(|expected| {
                        safe_reference(&expected.request_id)
                            && safe_reference(&expected.selection_snapshot_id)
                            && valid_version(&expected.policy_version)
                            && corpus_profile_name_is_safe(&expected.minimum_capability_profile)
                    })
        }
    }
}

fn corpus_profile_name_is_safe(value: &str) -> bool {
    safe_reference(value)
}

fn case_supports_acceptance(case: &EvaluationCase, criterion: AcceptanceCriterion) -> bool {
    match criterion {
        AcceptanceCriterion::M2Ac01 => case.expected_route.is_some(),
        AcceptanceCriterion::M2Ac02 => case
            .expected_classifier_reasons
            .contains(&router_policy::ClassifierReason::LowConfidenceUpwardGuard),
        AcceptanceCriterion::M2Ac03 => {
            case.expected_outcome == ExpectedOutcome::NoEligibleRoute
                && !case.expected_exclusions.is_empty()
        }
        AcceptanceCriterion::M2Ac04 => {
            case.input.fallback_cause.is_some() || case.input.previous_outcome.is_some()
        }
        AcceptanceCriterion::M2Ac05 => !case.input.runtime_observations.is_empty(),
        AcceptanceCriterion::M2Ac06 => case.record_expectations.is_some(),
        AcceptanceCriterion::M2Ac07 => case.expected_outcome == ExpectedOutcome::ShadowSelected,
        AcceptanceCriterion::M2Ac08 => case.metrics.capability_preserved,
        AcceptanceCriterion::M2Ac09 => case.metrics.routine_workload,
        AcceptanceCriterion::M2Ac10 => case.strategy_expectations.len() == 4,
        AcceptanceCriterion::M2Ac11 => !case.input.gate_states.is_empty(),
    }
}

fn aggregate_assertions_are_frozen(assertions: &[AggregateAssertion]) -> bool {
    matches!(
        assertions,
        [
            AggregateAssertion::MetricAtLeast {
                metric: RatioMetric::ExpectedRouteAccuracy,
                value,
                acceptance_criteria,
            },
            AggregateAssertion::MetricEquals {
                metric: RatioMetric::CapabilityPreservation,
                value: capability_value,
                acceptance_criteria: capability_acceptance,
            },
            AggregateAssertion::MetricAtLeast {
                metric: RatioMetric::RoutineFrontierAvoidance,
                value: routine_value,
                acceptance_criteria: routine_acceptance,
            },
            AggregateAssertion::MetricNonInferior {
                metric: CorrectnessMetric::IntelligentCorrectness,
                baseline: BaselineId::AlwaysFrontier,
                acceptance_criteria: non_inferior_acceptance,
            },
            AggregateAssertion::MetricStrictlyLess {
                metric: ScarcityMetric::RoutineStandardScarceCapacity,
                baselines,
                acceptance_criteria: scarce_acceptance,
            },
            AggregateAssertion::BaselineRowsPresent {
                baselines: row_baselines,
                policy_version,
                acceptance_criteria: row_acceptance,
            },
            AggregateAssertion::AllAutomaticRolesFullyGated {
                required_gates,
                acceptance_criteria: gate_acceptance,
            },
        ] if *value == 0.95
            && *capability_value == 1.0
            && *routine_value == 0.80
            && *acceptance_criteria == [AcceptanceCriterion::M2Ac08]
            && *capability_acceptance == [AcceptanceCriterion::M2Ac08]
            && *routine_acceptance == [AcceptanceCriterion::M2Ac09]
            && *non_inferior_acceptance == [AcceptanceCriterion::M2Ac10]
            && *scarce_acceptance == [AcceptanceCriterion::M2Ac10]
            && *row_acceptance == [AcceptanceCriterion::M2Ac10]
            && *gate_acceptance == [AcceptanceCriterion::M2Ac11]
            && baselines == &REQUIRED_BASELINES.map(|value| match value {
                "always_frontier" => BaselineId::AlwaysFrontier,
                "fixed_model_per_provider" => BaselineId::FixedModelPerProvider,
                _ => BaselineId::OrderedProviderFallbackOnly,
            })
            && row_baselines == baselines
            && policy_version == "1.0.0"
            && *required_gates == [
                RequiredGate::PolicyEvaluation,
                RequiredGate::ProtocolConformance,
                RequiredGate::ProviderSupport,
                RequiredGate::SecurityReview,
                RequiredGate::OperatorApproval,
            ]
    )
}

fn values_are_unique<T: Ord + Clone>(values: &[T]) -> bool {
    values.iter().cloned().collect::<BTreeSet<_>>().len() == values.len()
}

fn build_candidates(
    corpus: &EvaluationCorpus,
    case: &EvaluationCase,
    snapshot_id: &str,
) -> Result<Vec<Candidate>, EvaluationError> {
    case.input
        .candidate_ids
        .iter()
        .map(|id| {
            let mut snapshot = candidate_snapshot(corpus.routes.get(id), id, snapshot_id)?;
            if let Some(observation) = case.input.runtime_observations.get(id) {
                snapshot.estimated_latency_ms = observation.latency_ms;
                snapshot.estimated_cost_microunits = observation.estimated_cost_microunits;
            }
            apply_case_overrides(&mut snapshot, id, &case.case_id);
            if let Some(gates) = case.input.gate_states.get(id) {
                candidate_from_gates(snapshot, &corpus.policy_version, gates)
            } else if id == "reject-provider-support" {
                let fixture = GateStateFixture {
                    policy_evaluation: GateStatus::Passed,
                    protocol_conformance: GateStatus::Passed,
                    provider_support: GateStatus::Blocked,
                    security_review: GateStatus::Passed,
                    operator_approval: GateStatus::Passed,
                };
                candidate_from_gates(snapshot, &corpus.policy_version, &fixture)
            } else if id == "reject-policy-activation" {
                let fixture = GateStateFixture {
                    policy_evaluation: GateStatus::Passed,
                    protocol_conformance: GateStatus::Passed,
                    provider_support: GateStatus::Passed,
                    security_review: GateStatus::Passed,
                    operator_approval: GateStatus::Blocked,
                };
                candidate_from_gates(snapshot, &corpus.policy_version, &fixture)
            } else {
                Ok(Candidate::offline_fixture(snapshot))
            }
        })
        .collect()
}

fn candidate_snapshot(
    fixture: Option<&RouteFixture>,
    id: &str,
    snapshot_id: &str,
) -> Result<CandidateSnapshot, EvaluationError> {
    let default = RouteFixture {
        provider_id: "provider-a".to_owned(),
        model_id: format!("model:{id}"),
        account_pseudonym: "acct-a".to_owned(),
        endpoint_pseudonym: "endpoint-a".to_owned(),
        reasoning_effort: ReasoningEffort::Medium,
        frontier: false,
        scarce_capacity_units: 0,
    };
    let route = match fixture {
        Some(route) => route,
        None if SYNTHETIC_CANDIDATE_IDS.contains(&id) => &default,
        None => return Err(EvaluationError::InvalidFixture),
    };
    let roles = if id.contains("routine") {
        vec![Role::Routine]
    } else if id.contains("vision") {
        vec![Role::Vision]
    } else if id.contains("long-context") {
        vec![Role::LongContext]
    } else if id.contains("frontier") || id.contains("complex") {
        vec![
            Role::Routine,
            Role::Standard,
            Role::Complex,
            Role::Vision,
            Role::LongContext,
        ]
    } else {
        vec![Role::Standard]
    };
    Ok(CandidateSnapshot {
        candidate_id: id.to_owned(),
        selection_snapshot_id: snapshot_id.to_owned(),
        phase: if id.starts_with("fallback-") {
            "fallback".to_owned()
        } else {
            "primary".to_owned()
        },
        phase_priority: u32::from(id.starts_with("fallback-")),
        subagent_capable: true,
        provider_id: route.provider_id.clone(),
        account_pseudonym: route.account_pseudonym.clone(),
        model_id: route.model_id.clone(),
        reasoning_effort: route.reasoning_effort,
        endpoint_pseudonym: route.endpoint_pseudonym.clone(),
        billing_class: "offline_fixture".to_owned(),
        roles,
        capabilities: CapabilityDeclaration {
            wire_protocol: CapabilityState::Verified,
            streaming: CapabilityState::Verified,
            function_tools: CapabilityState::Verified,
            tool_result_continuation: CapabilityState::Verified,
            images: if id.contains("vision") || id.contains("frontier") {
                CapabilityState::Verified
            } else {
                CapabilityState::Unsupported
            },
            structured_output: CapabilityState::Verified,
            public_reasoning: CapabilityState::Verified,
            audio: CapabilityState::Unsupported,
            max_context_tokens: if id.contains("long-context") || id.contains("frontier") {
                200_000
            } else {
                32_768
            },
            privacy_modes: vec![PrivacyMode::ConfiguredProviderAllowed],
        },
        provider_status: ProviderStatus::Healthy,
        model_status: ModelStatus::Available,
        account_status: AccountStatus::Available,
        quota_headroom: Some(1.0),
        budget_headroom: Some(1.0),
        scarcity_score: route.scarce_capacity_units as f64,
        estimated_cost_microunits: 0,
        estimated_latency_ms: 1,
        state_refs: CandidateStateRefs {
            catalog: "offline-fixture:catalog".to_owned(),
            health: "offline-fixture:health".to_owned(),
            quota: "offline-fixture:quota".to_owned(),
            budget: "offline-fixture:budget".to_owned(),
            conformance: "offline-fixture:conformance".to_owned(),
        },
    })
}

fn apply_case_overrides(snapshot: &mut CandidateSnapshot, id: &str, case_id: &str) {
    if case_id == "ordered-hard-filters-empty" {
        snapshot.capabilities.wire_protocol = CapabilityState::Verified;
        snapshot.capabilities.streaming = CapabilityState::Verified;
        snapshot.capabilities.function_tools = CapabilityState::Verified;
        snapshot.capabilities.tool_result_continuation = CapabilityState::Verified;
        snapshot.capabilities.images = CapabilityState::Verified;
        snapshot.capabilities.structured_output = CapabilityState::Verified;
        snapshot.capabilities.public_reasoning = CapabilityState::Verified;
        snapshot.capabilities.audio = CapabilityState::Verified;
        snapshot.capabilities.max_context_tokens = 200_000;
        snapshot.capabilities.privacy_modes = vec![PrivacyMode::ConfiguredProviderAllowed];
    }
    match id {
        "reject-protocol" => snapshot.capabilities.wire_protocol = CapabilityState::Unknown,
        "reject-tools" => snapshot.capabilities.function_tools = CapabilityState::Unknown,
        "reject-modality" => snapshot.capabilities.images = CapabilityState::Unsupported,
        "reject-context" => snapshot.capabilities.max_context_tokens = 1,
        "reject-privacy" => snapshot.capabilities.privacy_modes.clear(),
        "reject-provider-status" => snapshot.provider_status = ProviderStatus::Unavailable,
        "reject-model-status" => snapshot.model_status = ModelStatus::Unavailable,
        "reject-account-status" => snapshot.account_status = AccountStatus::Unavailable,
        "reject-quota" => snapshot.quota_headroom = None,
        "reject-budget" => snapshot.budget_headroom = None,
        _ => {}
    }
    if case_id == "provider-fallback-preserves-capability" && id == "primary-standard" {
        snapshot.provider_status = ProviderStatus::Unavailable;
    }
}

fn comprehensive_filter_classification(
    classification: &router_policy::Classification,
) -> router_policy::Classification {
    let mut classification = classification.clone();
    classification.minimum_capability.function_tools = true;
    classification.minimum_capability.tool_result_continuation = true;
    classification.minimum_capability.images = true;
    classification.minimum_capability.structured_output = true;
    classification.minimum_capability.public_reasoning = true;
    classification.minimum_capability.audio = true;
    classification.minimum_capability.min_context_tokens = 200_000;
    classification
}

fn activation_gates(version: &str, fixture: &GateStateFixture) -> ActivationGates {
    let gate = |name: &str, status: GateStatus| ActivationGate {
        status,
        policy_version: version.to_owned(),
        evidence_refs: if status == GateStatus::Passed {
            vec![format!("offline-fixture:{name}")]
        } else {
            Vec::new()
        },
    };
    ActivationGates {
        policy_evaluation: gate("policy_evaluation", fixture.policy_evaluation),
        protocol_conformance: gate("protocol_conformance", fixture.protocol_conformance),
        provider_support: gate("provider_support", fixture.provider_support),
        security_review: gate("security_review", fixture.security_review),
        operator_approval: gate("operator_approval", fixture.operator_approval),
    }
}

fn candidate_from_gates(
    snapshot: CandidateSnapshot,
    version: &str,
    fixture: &GateStateFixture,
) -> Result<Candidate, EvaluationError> {
    let gates = activation_gates(version, fixture);
    let all_passed = gates.all_passed_for(version);
    let roles = [
        Role::Routine,
        Role::Standard,
        Role::Complex,
        Role::Vision,
        Role::LongContext,
    ]
    .into_iter()
    .map(|role| RoleDeclaration {
        role,
        quality: match role {
            Role::Routine => Quality::Routine,
            Role::Complex => Quality::Complex,
            Role::Standard | Role::Vision | Role::LongContext => Quality::Standard,
        },
        reasoning_efforts: vec![snapshot.reasoning_effort],
        capabilities: snapshot.capabilities.clone(),
        model_ids: vec![snapshot.model_id.clone()],
        escalates_to: None,
        estimated_quota_units: Some(0.0),
        estimated_cost_microunits: Some(0),
        conformance: ConformanceEvidence {
            complete: all_passed,
            policy_version: version.to_owned(),
            evidence_refs: if all_passed {
                vec!["offline-fixture:role-evidence".to_owned()]
            } else {
                Vec::new()
            },
        },
    })
    .collect();
    let pack = PolicyPack {
        schema_version: "1.0.0".to_owned(),
        policy_version: version.to_owned(),
        pack_id: format!("pack:{}", snapshot.candidate_id),
        provider_id: snapshot.provider_id.clone(),
        phase: snapshot.phase.clone(),
        billing_class: snapshot.billing_class.clone(),
        fixture_only: false,
        conformance_complete: all_passed,
        operator_approved: all_passed,
        automatic_live_eligible: all_passed,
        automatic_enabled: all_passed,
        live_enabled: all_passed,
        confidence_threshold: 0.80,
        roles,
        gates,
        state_refs: PolicyStateRefs {
            catalog: "offline-fixture:catalog".to_owned(),
            provider_support: "offline-fixture:provider-support".to_owned(),
            conformance: "offline-fixture:conformance".to_owned(),
        },
        disabled: DisabledPolicy {
            reasons: if all_passed {
                Vec::new()
            } else {
                vec!["activation_blocked".to_owned()]
            },
            remediation: Vec::new(),
        },
    };
    Candidate::from_policy_pack(snapshot, &pack).map_err(|_| EvaluationError::InvalidFixture)
}

fn route_matches(actual: &router_policy::SelectedRoute, expected: &ExpectedRoute) -> bool {
    actual.candidate_id == expected.candidate_id
        && actual.provider_id == expected.provider_id
        && actual.model_id == expected.model_id
        && actual.reasoning_effort == expected.reasoning_effort
}

fn no_eligible_route_matches(
    actual: &router_policy::NoEligibleRoute,
    expected: &ExpectedNoEligibleRoute,
    profiles: &BTreeMap<String, CapabilityRequirements>,
) -> bool {
    actual.code == "no_eligible_route"
        && actual.request_id == expected.request_id
        && actual.selection_snapshot_id == expected.selection_snapshot_id
        && actual.resolved_role == expected.resolved_role
        && profiles
            .get(&expected.minimum_capability_profile)
            .is_some_and(|profile| actual.minimum_capability == *profile)
        && actual.policy_version == expected.policy_version
        && actual.retryable == expected.retryable
}

fn exclusions_match(actual: &[router_policy::Exclusion], expected: &[ExpectedExclusion]) -> bool {
    actual.len() == expected.len()
        && actual.iter().zip(expected).all(|(actual, expected)| {
            actual.candidate_id == expected.candidate_id
                && actual.category == expected.category
                && actual.primary_reason == expected.primary_reason
                && expected
                    .diagnostic_reason
                    .as_ref()
                    .is_none_or(|reason| actual.diagnostic_reasons.contains(reason))
        })
}

fn execute_baseline(
    baseline: &BaselineFixture,
    snapshot: &SelectionSnapshot,
    classification: &router_policy::Classification,
    policy_version: &str,
) -> Option<String> {
    let eligible = snapshot
        .candidates()
        .iter()
        .filter(|candidate| hard_exclusion_for(candidate, classification, policy_version).is_none())
        .collect::<Vec<_>>();
    match baseline {
        BaselineFixture::StrongestHardEligibleInFirstEligiblePhase { .. } => {
            let phase = eligible
                .iter()
                .map(|candidate| candidate.snapshot().phase_priority)
                .min()?;
            eligible
                .into_iter()
                .filter(|candidate| candidate.snapshot().phase_priority == phase)
                .max_by(|left, right| {
                    left.snapshot()
                        .reasoning_effort
                        .cmp(&right.snapshot().reasoning_effort)
                        .then_with(|| {
                            right
                                .snapshot()
                                .candidate_id
                                .cmp(&left.snapshot().candidate_id)
                        })
                })
                .map(|candidate| candidate.snapshot().candidate_id.clone())
        }
        BaselineFixture::FixedProviderModelThenDescendWhenHardIneligible {
            fixed_model_ids,
            ..
        } => {
            let phases = eligible
                .iter()
                .map(|candidate| candidate.snapshot().phase_priority)
                .collect::<BTreeSet<_>>();
            for phase in phases {
                let providers = eligible
                    .iter()
                    .filter(|candidate| candidate.snapshot().phase_priority == phase)
                    .map(|candidate| candidate.snapshot().provider_id.as_str())
                    .collect::<BTreeSet<_>>();
                for provider in providers {
                    let Some(model_id) = fixed_model_ids.get(provider) else {
                        continue;
                    };
                    if let Some(candidate) = eligible.iter().find(|candidate| {
                        candidate.snapshot().phase_priority == phase
                            && candidate.snapshot().provider_id == provider
                            && candidate.snapshot().model_id == *model_id
                    }) {
                        return Some(candidate.snapshot().candidate_id.clone());
                    }
                }
            }
            None
        }
        BaselineFixture::OrderedCandidatesWithoutTaskRoleSelection {
            ordered_candidate_ids,
            ..
        } => ordered_candidate_ids.iter().find_map(|candidate_id| {
            eligible
                .iter()
                .find(|candidate| candidate.snapshot().candidate_id == *candidate_id)
                .map(|candidate| candidate.snapshot().candidate_id.clone())
        }),
    }
}

fn strategy_outcome(
    candidate_id: Option<String>,
    snapshot: &SelectionSnapshot,
    classification: &router_policy::Classification,
    policy_version: &str,
    expected_outcome: ExpectedOutcome,
    scarcity_by_id: &BTreeMap<String, u64>,
) -> StrategyOutcome {
    let candidate = candidate_id.as_deref().and_then(|id| {
        snapshot
            .candidates()
            .iter()
            .find(|candidate| candidate.snapshot().candidate_id == id)
    });
    let objective_correct = match expected_outcome {
        ExpectedOutcome::NoEligibleRoute => candidate.is_none(),
        ExpectedOutcome::Selected | ExpectedOutcome::ShadowSelected => {
            candidate.is_some_and(|candidate| {
                hard_exclusion_for(candidate, classification, policy_version).is_none()
                    && candidate_meets_quality_floor(candidate.snapshot(), classification)
            })
        }
    };
    let scarce_capacity_units = candidate_id
        .as_ref()
        .and_then(|id| scarcity_by_id.get(id))
        .copied()
        .unwrap_or_default();
    StrategyOutcome {
        candidate_id,
        objective_correct,
        scarce_capacity_units,
    }
}

fn execute_case_assertion(
    assertion: &CaseAssertion,
    classification: &router_policy::Classification,
    result: &Result<router_policy::SelectionDecision, Box<router_policy::NoEligibleRoute>>,
    decision_record: Option<&DecisionRecord>,
    strategy_outcomes: &BTreeMap<StrategyId, StrategyOutcome>,
    corpus: &EvaluationCorpus,
) -> bool {
    match assertion {
        CaseAssertion::Equals { path, value } => {
            let actual = match path {
                EqualsPath::ClassificationResolvedRole => {
                    ScalarValue::Text(serialized_name(classification.resolved_role))
                }
                EqualsPath::SelectedRouteCandidateId => ScalarValue::Text(
                    result
                        .as_ref()
                        .ok()
                        .map(|decision| decision.intelligent_route.candidate_id.clone())
                        .unwrap_or_default(),
                ),
                EqualsPath::ClassificationConfidence => {
                    ScalarValue::Number(classification.confidence)
                }
                EqualsPath::ClassificationFunctionTools => {
                    ScalarValue::Boolean(classification.minimum_capability.function_tools)
                }
                EqualsPath::ClassificationMinQuality => ScalarValue::Text(serialized_name(
                    classification.minimum_capability.min_quality,
                )),
                EqualsPath::ClassificationImages => {
                    ScalarValue::Boolean(classification.minimum_capability.images)
                }
                EqualsPath::ClassificationMinContextTokens => {
                    ScalarValue::Unsigned(classification.minimum_capability.min_context_tokens)
                }
                EqualsPath::Outcome => ScalarValue::Text(match result {
                    Ok(_) => "selected".to_owned(),
                    Err(_) => "no_eligible_route".to_owned(),
                }),
                EqualsPath::PolicyVersion | EqualsPath::EvaluationPolicyVersion => {
                    ScalarValue::Text(corpus.policy_version.clone())
                }
                EqualsPath::DecisionRecordMode => ScalarValue::Text(
                    decision_record
                        .map(|record| serialized_name(record.mode))
                        .unwrap_or_default(),
                ),
                EqualsPath::ShadowIntelligentDispatchCount => ScalarValue::Unsigned(
                    result
                        .as_ref()
                        .ok()
                        .map_or(0, |decision| decision.intelligent_dispatch_count),
                ),
                EqualsPath::DispatchCandidateId => ScalarValue::Text(
                    result
                        .as_ref()
                        .ok()
                        .map(|decision| decision.dispatch_route.candidate_id.clone())
                        .unwrap_or_default(),
                ),
            };
            scalar_values_equal(&actual, value)
        }
        CaseAssertion::Contains { path, value } => match path {
            ContainsPath::ClassificationReasons => classification
                .reasons
                .iter()
                .any(|reason| serialized_name(*reason) == *value),
            ContainsPath::ExclusionCategories => exclusions_for(result)
                .iter()
                .any(|exclusion| serialized_name(exclusion.category) == *value),
        },
        CaseAssertion::OrderedEquals { path, value } => match path {
            OrderedPath::ExclusionReasons => exclusions_for(result)
                .iter()
                .map(|exclusion| exclusion.primary_reason)
                .eq(value.iter().copied()),
        },
        CaseAssertion::FieldsAbsent { path, value } => match path {
            RecordPath::DecisionRecord => decision_record.is_some_and(|record| {
                serde_json::to_value(record).is_ok_and(|encoded| {
                    value
                        .iter()
                        .all(|field| !json_contains_key(&encoded, field.as_str()))
                })
            }),
        },
        CaseAssertion::RowSetEquals { path, value } => match path {
            RowSetPath::BaselineStrategyIds => corpus
                .baselines
                .iter()
                .map(BaselineFixture::id)
                .eq(value.iter().copied()),
        },
        CaseAssertion::LessThan {
            path,
            comparison_path,
        } => match (path, comparison_path) {
            (ScarcityPath::Intelligent, BaselineScarcityPath::AlwaysFrontier) => {
                let intelligent = strategy_outcomes.get(&StrategyId::Intelligent);
                let baseline = strategy_outcomes.get(&StrategyId::AlwaysFrontier);
                intelligent
                    .zip(baseline)
                    .is_some_and(|(intelligent, baseline)| {
                        intelligent.scarce_capacity_units < baseline.scarce_capacity_units
                    })
            }
        },
    }
}

fn scalar_values_equal(left: &ScalarValue, right: &ScalarValue) -> bool {
    left == right
}

fn serialized_name(value: impl Serialize) -> String {
    serde_json::to_value(value)
        .ok()
        .and_then(|value| value.as_str().map(str::to_owned))
        .unwrap_or_default()
}

fn exclusions_for(
    result: &Result<router_policy::SelectionDecision, Box<router_policy::NoEligibleRoute>>,
) -> &[router_policy::Exclusion] {
    match result {
        Ok(decision) => &decision.exclusions,
        Err(error) => &error.exclusions,
    }
}

fn record_expectations_pass(record: &DecisionRecord, expectations: &RecordExpectations) -> bool {
    if !expectations.append_only || record.selected_route_trace.len() != 7 {
        return false;
    }
    serde_json::to_value(record).is_ok_and(|encoded| {
        encoded.as_object().is_some_and(|object| {
            expectations
                .required_fields
                .iter()
                .all(|field| object.contains_key(field.as_str()))
        }) && expectations
            .forbidden_fields
            .iter()
            .all(|field| !json_contains_key(&encoded, field.as_str()))
    })
}

fn json_contains_key(value: &serde_json::Value, key: &str) -> bool {
    match value {
        serde_json::Value::Object(object) => {
            object.contains_key(key) || object.values().any(|value| json_contains_key(value, key))
        }
        serde_json::Value::Array(values) => {
            values.iter().any(|value| json_contains_key(value, key))
        }
        _ => false,
    }
}

fn strategy_expectation_matches(actual: &StrategyOutcome, expected: &StrategyExpectation) -> bool {
    actual.candidate_id.as_deref() == Some(expected.candidate_id.as_str())
        && actual.objective_correct == expected.objective_correct
        && actual.scarce_capacity_units == expected.scarce_capacity_units
}

#[allow(clippy::too_many_arguments)]
fn execute_aggregate_assertion(
    assertion: &AggregateAssertion,
    expected_route_accuracy: f64,
    capability_preservation: f64,
    routine_frontier_avoidance: f64,
    intelligent_correctness: f64,
    intelligent_scarce: u64,
    baseline_rows: &[BaselineReportRow],
    policy_version: &str,
) -> bool {
    match assertion {
        AggregateAssertion::MetricAtLeast { metric, value, .. } => {
            ratio_metric(
                *metric,
                expected_route_accuracy,
                capability_preservation,
                routine_frontier_avoidance,
            ) >= *value
        }
        AggregateAssertion::MetricEquals { metric, value, .. } => {
            ratio_metric(
                *metric,
                expected_route_accuracy,
                capability_preservation,
                routine_frontier_avoidance,
            ) == *value
        }
        AggregateAssertion::MetricNonInferior {
            metric, baseline, ..
        } => match metric {
            CorrectnessMetric::IntelligentCorrectness => baseline_rows
                .iter()
                .find(|row| row.strategy_id == baseline.as_str())
                .is_some_and(|row| intelligent_correctness >= row.correctness),
        },
        AggregateAssertion::MetricStrictlyLess {
            metric, baselines, ..
        } => match metric {
            ScarcityMetric::RoutineStandardScarceCapacity => baselines.iter().all(|baseline| {
                baseline_rows
                    .iter()
                    .find(|row| row.strategy_id == baseline.as_str())
                    .is_some_and(|row| intelligent_scarce < row.routine_standard_scarce_capacity)
            }),
        },
        AggregateAssertion::BaselineRowsPresent {
            baselines,
            policy_version: expected_version,
            ..
        } => {
            expected_version == policy_version
                && baseline_rows
                    .iter()
                    .map(|row| row.strategy_id.as_str())
                    .eq(baselines.iter().map(|baseline| baseline.as_str()))
        }
        AggregateAssertion::AllAutomaticRolesFullyGated { required_gates, .. } => {
            *required_gates
                == [
                    RequiredGate::PolicyEvaluation,
                    RequiredGate::ProtocolConformance,
                    RequiredGate::ProviderSupport,
                    RequiredGate::SecurityReview,
                    RequiredGate::OperatorApproval,
                ]
                && checked_in_packs_satisfy_automatic_gate_contract()
        }
    }
}

fn ratio_metric(
    metric: RatioMetric,
    expected_route_accuracy: f64,
    capability_preservation: f64,
    routine_frontier_avoidance: f64,
) -> f64 {
    match metric {
        RatioMetric::ExpectedRouteAccuracy => expected_route_accuracy,
        RatioMetric::CapabilityPreservation => capability_preservation,
        RatioMetric::RoutineFrontierAvoidance => routine_frontier_avoidance,
    }
}

fn checked_in_packs_satisfy_automatic_gate_contract() -> bool {
    // The five PRD-001y live-granted packs (openai, ollama-cloud, openrouter,
    // deepseek, qwen) claim live only through all five evidence-backed gates,
    // re-qualified on the 2026-08-24 frontier (deepseek after its account was
    // topped up and qwen after the token-plan model catalog fix, then all five
    // re-qualified on frontier pins). The remaining pack, kimi, was never
    // granted a live authority under the five-provider grant and must fail
    // closed for automatic live routing.
    [
        include_bytes!("../../../policy/providers/openai.json").as_slice(),
        include_bytes!("../../../policy/providers/ollama-cloud.json").as_slice(),
        include_bytes!("../../../policy/providers/openrouter.json").as_slice(),
        include_bytes!("../../../policy/providers/deepseek.json").as_slice(),
        include_bytes!("../../../policy/providers/qwen.json").as_slice(),
    ]
    .into_iter()
    .all(|bytes| {
        PolicyPack::from_json(bytes).is_ok_and(|pack| {
            pack.roles.len() == 5
                && !pack.fixture_only
                && pack.require_automatic_live_eligibility().is_ok()
        })
    }) && [include_bytes!("../../../policy/providers/kimi.json").as_slice()]
        .into_iter()
        .all(|bytes| {
            PolicyPack::from_json(bytes).is_ok_and(|pack| {
                pack.roles.len() == 5 && pack.require_automatic_live_eligibility().is_err()
            })
        })
}

fn ratio(numerator: u64, denominator: u64) -> f64 {
    if denominator == 0 {
        0.0
    } else {
        numerator as f64 / denominator as f64
    }
}

fn valid_version(value: &str) -> bool {
    if value.is_empty()
        || value.len() > 64
        || contains_sensitive_marker(value)
        || !value
            .bytes()
            .all(|byte| byte.is_ascii_digit() || byte == b'.')
    {
        return false;
    }
    let mut parts = value.split('.');
    matches!(
        (parts.next(), parts.next(), parts.next(), parts.next()),
        (Some(a), Some(b), Some(c), None)
            if [a, b, c].into_iter().all(|part| !part.is_empty() && part.bytes().all(|byte| byte.is_ascii_digit()))
    )
}

fn safe_reference(value: &str) -> bool {
    !value.is_empty()
        && value.len() <= 256
        && !value.contains('@')
        && !contains_sensitive_marker(value)
        && !looks_like_sensitive_number(value)
        && value.bytes().all(|byte| {
            byte.is_ascii_alphanumeric() || matches!(byte, b'-' | b'_' | b'.' | b':' | b'/' | b'@')
        })
}

fn contains_sensitive_marker(value: &str) -> bool {
    let lowered = value.to_ascii_lowercase();
    let sensitive_word = [
        "http://", "https://", "bearer", "token", "secret", "password", "api_key", "apikey",
        "cookie",
    ]
    .iter()
    .any(|marker| lowered.contains(marker));
    let sensitive_prefix = [
        "sk-",
        "sk_",
        "rk_live_",
        "pk_live_",
        "ghp_",
        "github_pat_",
        "xoxb-",
        "xoxp-",
        "akia",
        "eyj",
    ]
    .iter()
    .any(|marker| {
        lowered.match_indices(marker).any(|(index, _)| {
            index == 0
                || lowered
                    .as_bytes()
                    .get(index - 1)
                    .is_some_and(|byte| matches!(byte, b':' | b'/' | b'_' | b'-' | b'.'))
        })
    });
    sensitive_word || sensitive_prefix
}

fn looks_like_sensitive_number(value: &str) -> bool {
    if !value
        .bytes()
        .all(|byte| byte.is_ascii_digit() || byte == b'-')
    {
        return false;
    }
    let digits = value.bytes().filter(u8::is_ascii_digit).count();
    matches!(digits, 9 | 15 | 16 | 19)
}

fn sha256_hex(bytes: &[u8]) -> String {
    let digest = Sha256::digest(bytes);
    let mut output = String::with_capacity(digest.len() * 2);
    for byte in digest {
        let _ = write!(&mut output, "{byte:02x}");
    }
    output
}