u280_hardware_promoter/

route.rs

//! Typed policy boundary for a future exact accepted-route parser.
//!
//! This module deliberately defines no AMD report or xclbin wire format. A
//! future descriptor-retaining parser must derive [`RoutePolicyInputs`] from the
//! immutable files already named by [`PromotionRequest`]. The metadata policy
//! validator still cannot construct [`AcceptedRouteEvidence`]; only a future
//! parser-owned retained-descriptor guard can make that type inhabitable. The
//! current public entry point remains fail-closed while the tracked Vitis
//! format profile is `adaptation-required`.

use crate::canonical::{hex_lower, is_lower_hex};
use crate::model::{
    BASELINE_CLOCK_HZ, MAXIMUM_DSPS, MAXIMUM_LUTS, MAXIMUM_REGISTERS, PERFORMANCE_PROFILE,
    PromotionRequest, RequestFileLocator, validate_absolute_path,
};
use crate::{FailureCode, PromotionError, PromotionResult};
use sha2::{Digest as _, Sha256};
use std::collections::BTreeSet;

const ROUTE_ADAPTATION_STATUS: &str = "adaptation-required";
const ACCEPTANCE_EVIDENCE_TIER: &str = "vitis-link-route";
const ACCEPTANCE_CAPTURE_KIND: &str = "acceptance-link";
const ACCEPTANCE_STATUS: &str = "pass";
const REQUIRED_AMD_RELEASE: &str = "2023.2";
const REQUIRED_PLATFORM: &str = "xilinx_u280_gen3x16_xdma_1_202211_1";
const REQUIRED_DEVICE_PART: &str = "xcu280-fsvh2892-2L-e";
const REQUIRED_XCLBIN_TARGET: &str = "hw";
const REPORT_SET_DIGEST_DOMAIN: &[u8] = b"hashsigs-u280-route-report-set-v1\0";
const XCLBIN_IDENTITY_DIGEST_DOMAIN: &[u8] = b"hashsigs-u280-route-xclbin-identity-v1\0";
// Matches `FILE_BOUNDARY_LIMITS.maxRunFiles` in the stable Vitis contract. A
// future parser must reject a larger descriptor-derived report set before
// reaching this model.
const MAXIMUM_RAW_ROUTE_REPORTS: usize = 100_000;

/// One opaque accepted 250 MHz route-policy proof.
///
/// The type has no public constructor, serde implementation, or `Clone`
/// implementation. Its private retained-descriptor guard is uninhabited in
/// this source slice, so even module-private metadata policy validation cannot
/// construct it. A future exact parser must install the descriptor guard and
/// revalidate it before this type can become inhabited.
///
/// ```compile_fail
/// use u280_hardware_promoter::AcceptedRouteEvidence;
///
/// fn assert_clone<T: Clone>() {}
/// assert_clone::<AcceptedRouteEvidence>();
/// ```
///
/// ```compile_fail
/// use serde::de::DeserializeOwned;
/// use u280_hardware_promoter::AcceptedRouteEvidence;
///
/// fn assert_deserializable<T: DeserializeOwned>() {}
/// assert_deserializable::<AcceptedRouteEvidence>();
/// ```
///
/// ```compile_fail
/// use u280_hardware_promoter::AcceptedRouteEvidence;
///
/// fn external_representation_is_private(value: AcceptedRouteEvidence) {
///     let AcceptedRouteEvidence {
///         policy: _,
///         retained_descriptors: _,
///     } = value;
/// }
/// ```
#[derive(Debug)]
pub struct AcceptedRouteEvidence {
    policy: ValidatedRoutePolicy,
    #[allow(dead_code)] // Replaced by the future parser-owned descriptor guard.
    retained_descriptors: RetainedRouteDescriptorGuard,
}

/// Metadata policy output that is deliberately insufficient for acceptance.
#[derive(Debug)]
struct ValidatedRoutePolicy {
    design_digest: String,
    actual_routed_hz: u64,
    setup_wns_femtoseconds: i64,
    hold_whs_femtoseconds: i64,
    whole_design_luts: u64,
    whole_design_registers: u64,
    whole_design_dsps: u64,
    stage_manifest: RouteArtifactBinding,
    run_inventory: RouteArtifactBinding,
    route_seal: RouteArtifactBinding,
    raw_reports: Vec<RouteArtifactBinding>,
    routed_clock_evidence: RouteArtifactBinding,
    xclbin_identity: RouteXclbinIdentity,
}

/// Placeholder preventing metadata-only policy output from becoming evidence.
#[derive(Debug)]
enum RetainedRouteDescriptorGuard {}

impl AcceptedRouteEvidence {
    /// Design-family digest joining the accepted 250 MHz stage and route.
    #[must_use]
    pub fn design_digest(&self) -> &str {
        &self.policy.design_digest
    }

    /// Actual routed clock accepted from the exact 250 MHz route proof.
    #[must_use]
    pub const fn actual_routed_hz(&self) -> u64 {
        self.policy.actual_routed_hz
    }

    /// Exact accepted setup worst negative slack, represented in femtoseconds.
    #[must_use]
    pub const fn setup_wns_femtoseconds(&self) -> i64 {
        self.policy.setup_wns_femtoseconds
    }

    /// Exact accepted hold worst hold slack, represented in femtoseconds.
    #[must_use]
    pub const fn hold_whs_femtoseconds(&self) -> i64 {
        self.policy.hold_whs_femtoseconds
    }

    /// Whole-routed-design LUT count, including shell resources.
    #[must_use]
    pub const fn whole_design_luts(&self) -> u64 {
        self.policy.whole_design_luts
    }

    /// Whole-routed-design register count, including shell resources.
    #[must_use]
    pub const fn whole_design_registers(&self) -> u64 {
        self.policy.whole_design_registers
    }

    /// Whole-routed-design DSP count, including shell resources.
    #[must_use]
    pub const fn whole_design_dsps(&self) -> u64 {
        self.policy.whole_design_dsps
    }

    #[allow(dead_code)] // Consumed by the later final-evidence adapter.
    pub(crate) const fn stage_manifest(&self) -> &RouteArtifactBinding {
        &self.policy.stage_manifest
    }

    #[allow(dead_code)] // Consumed by the later final-evidence adapter.
    pub(crate) const fn run_inventory(&self) -> &RouteArtifactBinding {
        &self.policy.run_inventory
    }

    #[allow(dead_code)] // Consumed by the later final-evidence adapter.
    pub(crate) const fn route_seal(&self) -> &RouteArtifactBinding {
        &self.policy.route_seal
    }

    #[allow(dead_code)] // Consumed by the later final-evidence adapter.
    pub(crate) fn raw_reports(&self) -> &[RouteArtifactBinding] {
        &self.policy.raw_reports
    }

    #[allow(dead_code)] // Consumed by the later final-evidence adapter.
    pub(crate) const fn routed_clock_evidence(&self) -> &RouteArtifactBinding {
        &self.policy.routed_clock_evidence
    }

    #[allow(dead_code)] // Consumed by the later final-evidence adapter.
    pub(crate) const fn xclbin(&self) -> &RouteArtifactBinding {
        &self.policy.xclbin_identity.subject
    }

    #[allow(dead_code)] // Consumed by the later final-evidence adapter.
    pub(crate) const fn xclbin_identity(&self) -> &RouteXclbinIdentity {
        &self.policy.xclbin_identity
    }
}

/// Fails closed until an immutable format probe has produced an exact parser
/// contract and a later clean commit installs that parser.
///
/// The typed policy model in this module is not a parser and cannot make the
/// current format-probe capture promotable.
///
/// # Errors
///
/// Always returns [`FailureCode::RouteUnaccepted`] in this source slice.
pub fn require_accepted_route(
    _request: &PromotionRequest,
) -> PromotionResult<AcceptedRouteEvidence> {
    Err(PromotionError::new(
        FailureCode::RouteUnaccepted,
        format!(
            "Vitis route evidence status is {ROUTE_ADAPTATION_STATUS}; exact accepted-route parser is unavailable"
        ),
    ))
}

/// Exact artifact subject derived by the future descriptor-retaining parser.
///
/// The parser must derive the byte identity and physical subject from one
/// retained regular-file descriptor. This type is crate-private and is not
/// deserializable; caller-supplied path or digest metadata cannot construct it.
#[derive(Debug, Eq, PartialEq)]
pub(crate) struct RouteArtifactBinding {
    absolute_path: String,
    bytes: u64,
    sha256: String,
    descriptor: ParserDescriptorSubject,
}

/// Physical identity sampled from the retained parser-owned descriptor.
#[derive(Debug, Eq, PartialEq)]
struct ParserDescriptorSubject {
    canonical_realpath: String,
    device: u64,
    inode: u64,
}

impl RouteArtifactBinding {
    #[allow(dead_code)] // Future exact parser output constructor.
    fn from_exact_parser(
        absolute_path: String,
        canonical_realpath: String,
        bytes: u64,
        sha256: String,
        device: u64,
        inode: u64,
    ) -> Self {
        Self {
            absolute_path,
            bytes,
            sha256,
            descriptor: ParserDescriptorSubject {
                canonical_realpath,
                device,
                inode,
            },
        }
    }

    pub(crate) fn absolute_path(&self) -> &str {
        &self.absolute_path
    }

    #[allow(dead_code)] // Consumed by the future retained-descriptor guard.
    pub(crate) fn canonical_realpath(&self) -> &str {
        &self.descriptor.canonical_realpath
    }

    #[allow(dead_code)] // Consumed by the later final-evidence adapter.
    pub(crate) const fn bytes(&self) -> u64 {
        self.bytes
    }

    #[allow(dead_code)] // Consumed by the later final-evidence adapter.
    pub(crate) fn sha256(&self) -> &str {
        &self.sha256
    }

    #[allow(dead_code)] // Consumed by the future retained-descriptor guard.
    pub(crate) const fn device(&self) -> u64 {
        self.descriptor.device
    }

    #[allow(dead_code)] // Consumed by the future retained-descriptor guard.
    pub(crate) const fn inode(&self) -> u64 {
        self.descriptor.inode
    }

    fn validate(&self, label: &str) -> PromotionResult<()> {
        validate_absolute_path(&self.absolute_path, label)?;
        validate_absolute_path(&self.descriptor.canonical_realpath, label)?;
        if self.absolute_path != self.descriptor.canonical_realpath {
            return Err(PromotionError::new(
                FailureCode::IdentityJoin,
                format!("{label} pathname differs from its descriptor-derived canonical realpath"),
            ));
        }
        if self.descriptor.inode == 0 {
            return Err(PromotionError::new(
                FailureCode::Noncanonical,
                format!("{label} has an invalid zero descriptor inode"),
            ));
        }
        if self.bytes == 0 || !is_lower_hex(&self.sha256, 64, true) {
            return Err(PromotionError::new(
                FailureCode::Noncanonical,
                format!("{label} has a zero length or non-canonical SHA-256"),
            ));
        }
        Ok(())
    }

    fn require_request_binding(
        &self,
        request: &RequestFileLocator<'_>,
        label: &str,
    ) -> PromotionResult<()> {
        if self.absolute_path != request.absolute_path()
            || self.bytes != request.bytes()
            || self.sha256 != request.sha256()
        {
            return Err(PromotionError::new(
                FailureCode::IdentityJoin,
                format!("{label} differs from the exact promotion-request binding"),
            ));
        }
        Ok(())
    }
}

/// Route-derived xclbin identity retained for the later exact card join.
///
/// This type has no constructor outside the route parser module, no serde
/// implementation, and no `Clone` implementation. It deliberately contains no
/// physical-card fields. Its internal transcript joins every identity field to
/// one exact descriptor-derived xclbin subject.
#[derive(Debug)]
pub(crate) struct RouteXclbinIdentity {
    subject: RouteArtifactBinding,
    uuid: String,
    interface_uuid: String,
    deployment_platform: String,
    fpga_part: String,
    target: String,
    descriptor_identity_sha256: String,
}

impl RouteXclbinIdentity {
    #[allow(dead_code)] // Future exact parser output constructor.
    fn from_exact_parser(
        subject: RouteArtifactBinding,
        uuid: String,
        interface_uuid: String,
        deployment_platform: String,
        fpga_part: String,
        target: String,
    ) -> PromotionResult<Self> {
        let descriptor_identity_sha256 = xclbin_identity_sha256(
            &subject,
            &uuid,
            &interface_uuid,
            &deployment_platform,
            &fpga_part,
            &target,
        )?;
        Ok(Self {
            subject,
            uuid,
            interface_uuid,
            deployment_platform,
            fpga_part,
            target,
            descriptor_identity_sha256,
        })
    }

    #[allow(dead_code)] // Consumed by the later final-evidence adapter.
    pub(crate) const fn subject(&self) -> &RouteArtifactBinding {
        &self.subject
    }

    #[allow(dead_code)] // Consumed by the later final-evidence adapter.
    pub(crate) fn uuid(&self) -> &str {
        &self.uuid
    }

    #[allow(dead_code)] // Consumed by the later final-evidence adapter.
    pub(crate) fn interface_uuid(&self) -> &str {
        &self.interface_uuid
    }

    #[allow(dead_code)] // Consumed by the later final-evidence adapter.
    pub(crate) fn deployment_platform(&self) -> &str {
        &self.deployment_platform
    }

    #[allow(dead_code)] // Consumed by the later final-evidence adapter.
    pub(crate) fn fpga_part(&self) -> &str {
        &self.fpga_part
    }

    #[allow(dead_code)] // Consumed by the later final-evidence adapter.
    pub(crate) fn target(&self) -> &str {
        &self.target
    }
}

#[allow(dead_code)] // Kernel-only is an explicit adversarial parser output.
#[derive(Clone, Copy, Debug, Eq, PartialEq)]
enum ResourceScope {
    WholeRoutedDesignIncludingShell,
    KernelHierarchyOnly,
}

#[derive(Debug)]
struct RouteIdentityObservation {
    evidence_tier: String,
    capture_kind: String,
    status: String,
    profile: String,
    amd_release: String,
    deployment_platform: String,
    device_part: String,
    route_design_digest: String,
    requested_clock_hz: u64,
    actual_routed_hz: u64,
}

/// Identity independently derived while revalidating the stage manifest.
#[derive(Debug)]
struct StageManifestIdentityObservation {
    source: RouteArtifactBinding,
    route_provenance: RouteObservationProvenance,
    stage_subject_sha256: String,
    design_digest: String,
}

/// Stage identity independently derived while revalidating the run inventory.
#[derive(Debug)]
struct RunInventoryIdentityObservation {
    source: RouteArtifactBinding,
    route_provenance: RouteObservationProvenance,
    stage_subject_sha256: String,
    design_digest: String,
}

/// Exact evidence subjects attached to one parser-derived route observation.
///
/// The future parser constructs this alongside its typed observation. Every
/// subject is descriptor-derived and the raw-report closure is recomputed by
/// this policy layer before the observation can be used.
#[derive(Debug)]
struct RouteObservationProvenance {
    run_inventory: RouteArtifactBinding,
    route_seal: RouteArtifactBinding,
    raw_report_set_sha256: String,
    source_report: RouteArtifactBinding,
}

/// One parser-derived observation inseparable from its exact evidence closure.
#[derive(Debug)]
struct BoundRouteObservation<T> {
    provenance: RouteObservationProvenance,
    value: T,
}

#[allow(clippy::struct_excessive_bools)] // Independent route-state observations.
#[derive(Debug)]
struct RouteStatusObservation {
    placed_fully: bool,
    routed_fully: bool,
    partially_routed: bool,
    route_errors: bool,
}

#[derive(Debug)]
struct RouteTimingObservation {
    setup_wns_femtoseconds: i64,
    hold_whs_femtoseconds: i64,
    setup_path_count: u64,
    hold_path_count: u64,
    unconstrained_path_count: u64,
    unconstrained_endpoint_count: u64,
    complete_timing_coverage: bool,
}

#[derive(Debug)]
struct RouteDrcObservation {
    complete_no_waivers_evaluation: bool,
    enabled_error_violations: u64,
    enabled_fatal_violations: u64,
    installed_waivers: u64,
}

#[derive(Debug)]
struct RouteResourceObservation {
    scope: ResourceScope,
    luts: u64,
    registers: u64,
    dsps: u64,
    declared_lut_cap: u64,
    declared_register_cap: u64,
    declared_dsp_cap: u64,
}

#[allow(clippy::struct_excessive_bools)] // Lower-tier nonclaim fields are independent.
#[derive(Debug)]
struct RouteNonclaims {
    hardware_execution: bool,
    card_validated: bool,
    cryptographic_outputs_valid: bool,
    performance_validated: bool,
    hardware_completion_promotable: bool,
}

/// Typed values that a future exact AMD-format parser must derive from retained
/// route descriptors.
///
/// This is deliberately not a serde wire and defines no AMD syntax. The
/// validator below checks only identity joins and route policy; descriptor and
/// raw-format verification remain mandatory before constructing this input.
#[derive(Debug)]
struct RoutePolicyInputs {
    identity: BoundRouteObservation<RouteIdentityObservation>,
    stage_identity: StageManifestIdentityObservation,
    inventory_identity: RunInventoryIdentityObservation,
    status: BoundRouteObservation<RouteStatusObservation>,
    timing: BoundRouteObservation<RouteTimingObservation>,
    drc: BoundRouteObservation<RouteDrcObservation>,
    resources: BoundRouteObservation<RouteResourceObservation>,
    nonclaims: RouteNonclaims,
    stage_manifest: RouteArtifactBinding,
    run_inventory: RouteArtifactBinding,
    route_seal: RouteArtifactBinding,
    inventory_raw_reports: Vec<RouteArtifactBinding>,
    seal_raw_reports: Vec<RouteArtifactBinding>,
    routed_clock_evidence: RouteArtifactBinding,
    xclbin_identity: RouteXclbinIdentity,
    inventory_routed_clock_evidence: RouteArtifactBinding,
    inventory_xclbin: RouteArtifactBinding,
    seal_run_inventory: RouteArtifactBinding,
    seal_routed_clock_evidence: RouteArtifactBinding,
    seal_xclbin: RouteArtifactBinding,
}

/// Applies the accepted-route identity, timing, DRC, and whole-design resource
/// policy to typed output from a future exact parser.
///
/// This function does not parse AMD bytes and is not called by the current
/// public entry point. Keeping it module-private prevents a caller-authored DTO
/// or an unrelated crate module from becoming route evidence.
#[allow(dead_code, clippy::large_types_passed_by_value, clippy::too_many_lines)] // Connected only after the exact accepted-route parser lands.
fn validate_route_policy_inputs(
    request: &PromotionRequest,
    input: RoutePolicyInputs,
) -> PromotionResult<ValidatedRoutePolicy> {
    validate_nonclaims(&input.nonclaims)?;

    for (artifact, label) in [
        (&input.stage_manifest, "route stage manifest"),
        (&input.run_inventory, "route run inventory"),
        (&input.route_seal, "accepted route seal"),
        (&input.routed_clock_evidence, "routed-clock evidence"),
        (&input.xclbin_identity.subject, "routed xclbin"),
        (
            &input.inventory_routed_clock_evidence,
            "inventory routed-clock binding",
        ),
        (&input.inventory_xclbin, "inventory xclbin binding"),
        (&input.seal_run_inventory, "route-seal inventory binding"),
        (
            &input.seal_routed_clock_evidence,
            "route-seal routed-clock binding",
        ),
        (&input.seal_xclbin, "route-seal xclbin binding"),
    ] {
        artifact.validate(label)?;
    }

    let locators = request.route_locators();
    input
        .stage_manifest
        .require_request_binding(locators.staged_run_manifest(), "route stage manifest")?;
    input
        .run_inventory
        .require_request_binding(locators.complete_run_inventory(), "route run inventory")?;
    input
        .route_seal
        .require_request_binding(locators.accepted_250mhz_route_seal(), "accepted route seal")?;
    require_strict_child(
        locators.staged_run_root().absolute_path(),
        input.stage_manifest.absolute_path(),
        "route stage manifest",
    )?;
    require_strict_child(
        locators.acceptance_run_root().absolute_path(),
        input.routed_clock_evidence.absolute_path(),
        "routed-clock evidence",
    )?;
    require_strict_child(
        locators.acceptance_run_root().absolute_path(),
        input.xclbin_identity.subject.absolute_path(),
        "routed xclbin",
    )?;
    require_same_artifact(
        &input.run_inventory,
        &input.seal_run_inventory,
        "route seal to run inventory",
    )?;
    require_same_artifact(
        &input.routed_clock_evidence,
        &input.inventory_routed_clock_evidence,
        "run inventory to routed-clock evidence",
    )?;
    require_same_artifact(
        &input.routed_clock_evidence,
        &input.seal_routed_clock_evidence,
        "route seal to routed-clock evidence",
    )?;
    require_same_artifact(
        &input.xclbin_identity.subject,
        &input.inventory_xclbin,
        "run inventory to xclbin",
    )?;
    require_same_artifact(
        &input.xclbin_identity.subject,
        &input.seal_xclbin,
        "route seal to xclbin",
    )?;
    validate_raw_report_bindings(
        locators.acceptance_run_root().absolute_path(),
        &input.inventory_raw_reports,
        &input.seal_raw_reports,
    )?;

    let mut paths = BTreeSet::new();
    let mut physical_subjects = BTreeSet::new();
    for artifact in [
        &input.stage_manifest,
        &input.run_inventory,
        &input.route_seal,
        &input.routed_clock_evidence,
        &input.xclbin_identity.subject,
    ] {
        require_unique_artifact_subject(&mut paths, &mut physical_subjects, artifact)?;
    }
    for report in &input.inventory_raw_reports {
        require_unique_artifact_subject(&mut paths, &mut physical_subjects, report)?;
    }

    let report_set_sha256 = canonical_raw_report_set_sha256(&input.inventory_raw_reports)?;
    for (provenance, label) in [
        (&input.identity.provenance, "route identity observation"),
        (
            &input.stage_identity.route_provenance,
            "stage identity observation",
        ),
        (
            &input.inventory_identity.route_provenance,
            "run-inventory identity observation",
        ),
        (&input.status.provenance, "route status observation"),
        (&input.timing.provenance, "route timing observation"),
        (&input.drc.provenance, "route DRC observation"),
        (&input.resources.provenance, "route resource observation"),
    ] {
        validate_observation_provenance(
            provenance,
            &input.run_inventory,
            &input.route_seal,
            &input.inventory_raw_reports,
            &report_set_sha256,
            label,
        )?;
    }

    validate_identity(&input.identity.value)?;
    validate_route_status(&input.status.value)?;
    validate_timing(&input.timing.value)?;
    validate_drc(&input.drc.value)?;
    validate_resources(&input.resources.value)?;
    validate_stage_identity_join(
        &input.identity.value,
        &input.stage_identity,
        &input.inventory_identity,
        &input.stage_manifest,
        &input.run_inventory,
    )?;
    validate_xclbin_identity(&input.identity.value, &input.xclbin_identity)?;

    Ok(ValidatedRoutePolicy {
        design_digest: input.identity.value.route_design_digest,
        actual_routed_hz: input.identity.value.actual_routed_hz,
        setup_wns_femtoseconds: input.timing.value.setup_wns_femtoseconds,
        hold_whs_femtoseconds: input.timing.value.hold_whs_femtoseconds,
        whole_design_luts: input.resources.value.luts,
        whole_design_registers: input.resources.value.registers,
        whole_design_dsps: input.resources.value.dsps,
        stage_manifest: input.stage_manifest,
        run_inventory: input.run_inventory,
        route_seal: input.route_seal,
        raw_reports: input.inventory_raw_reports,
        routed_clock_evidence: input.routed_clock_evidence,
        xclbin_identity: input.xclbin_identity,
    })
}

fn validate_identity(identity: &RouteIdentityObservation) -> PromotionResult<()> {
    let fixed_identity = identity.evidence_tier == ACCEPTANCE_EVIDENCE_TIER
        && identity.capture_kind == ACCEPTANCE_CAPTURE_KIND
        && identity.status == ACCEPTANCE_STATUS
        && identity.profile == PERFORMANCE_PROFILE
        && identity.amd_release == REQUIRED_AMD_RELEASE
        && identity.deployment_platform == REQUIRED_PLATFORM
        && identity.device_part == REQUIRED_DEVICE_PART
        && is_lower_hex(&identity.route_design_digest, 64, true)
        && identity.requested_clock_hz == BASELINE_CLOCK_HZ;
    if !fixed_identity {
        return Err(PromotionError::new(
            FailureCode::RouteUnaccepted,
            "route parser output does not identify the exact SHA-256 U280 250 MHz acceptance design",
        ));
    }
    if identity.actual_routed_hz < BASELINE_CLOCK_HZ {
        return Err(PromotionError::new(
            FailureCode::RouteTiming,
            format!(
                "actual routed clock {} Hz is below the required {} Hz baseline",
                identity.actual_routed_hz, BASELINE_CLOCK_HZ
            ),
        ));
    }
    Ok(())
}

fn validate_stage_identity_join(
    route: &RouteIdentityObservation,
    stage: &StageManifestIdentityObservation,
    inventory: &RunInventoryIdentityObservation,
    stage_manifest: &RouteArtifactBinding,
    run_inventory: &RouteArtifactBinding,
) -> PromotionResult<()> {
    stage.source.validate("stage identity source")?;
    inventory.source.validate("run-inventory identity source")?;
    let canonical = is_lower_hex(&stage.stage_subject_sha256, 64, true)
        && is_lower_hex(&inventory.stage_subject_sha256, 64, true)
        && is_lower_hex(&stage.design_digest, 64, true)
        && is_lower_hex(&inventory.design_digest, 64, true);
    if !canonical {
        return Err(PromotionError::new(
            FailureCode::Noncanonical,
            "stage-manifest or run-inventory identity contains a non-canonical digest",
        ));
    }
    if &stage.source != stage_manifest
        || &inventory.source != run_inventory
        || stage.stage_subject_sha256 != stage_manifest.sha256
        || inventory.stage_subject_sha256 != stage.stage_subject_sha256
        || stage.design_digest != route.route_design_digest
        || inventory.design_digest != stage.design_digest
    {
        return Err(PromotionError::new(
            FailureCode::IdentityJoin,
            "stage manifest and run inventory do not independently join one stage subject and design family",
        ));
    }
    Ok(())
}

fn validate_xclbin_identity(
    route: &RouteIdentityObservation,
    xclbin: &RouteXclbinIdentity,
) -> PromotionResult<()> {
    if !is_canonical_uuid(&xclbin.uuid) || !is_canonical_uuid(&xclbin.interface_uuid) {
        return Err(PromotionError::new(
            FailureCode::Noncanonical,
            "route-derived xclbin UUID or interface UUID is not canonical",
        ));
    }
    if xclbin.deployment_platform != route.deployment_platform
        || xclbin.fpga_part != route.device_part
    {
        return Err(PromotionError::new(
            FailureCode::IdentityJoin,
            "route-derived xclbin platform or FPGA part differs from the accepted route",
        ));
    }
    if xclbin.target != REQUIRED_XCLBIN_TARGET {
        return Err(PromotionError::new(
            FailureCode::RouteUnaccepted,
            "accepted route xclbin target is not hw",
        ));
    }
    if !is_lower_hex(&xclbin.descriptor_identity_sha256, 64, true)
        || xclbin.descriptor_identity_sha256
            != xclbin_identity_sha256(
                &xclbin.subject,
                &xclbin.uuid,
                &xclbin.interface_uuid,
                &xclbin.deployment_platform,
                &xclbin.fpga_part,
                &xclbin.target,
            )?
    {
        return Err(PromotionError::new(
            FailureCode::IdentityJoin,
            "route-derived xclbin identity is not bound to its exact descriptor subject",
        ));
    }
    Ok(())
}

fn validate_route_status(status: &RouteStatusObservation) -> PromotionResult<()> {
    if !status.placed_fully
        || !status.routed_fully
        || status.partially_routed
        || status.route_errors
    {
        return Err(PromotionError::new(
            FailureCode::RouteTiming,
            "accepted route must be completely placed and routed with no route errors",
        ));
    }
    Ok(())
}

fn validate_timing(timing: &RouteTimingObservation) -> PromotionResult<()> {
    if !timing.complete_timing_coverage
        || timing.setup_path_count == 0
        || timing.hold_path_count == 0
        || timing.unconstrained_path_count != 0
        || timing.unconstrained_endpoint_count != 0
        || timing.setup_wns_femtoseconds < 0
        || timing.hold_whs_femtoseconds < 0
    {
        return Err(PromotionError::new(
            FailureCode::RouteTiming,
            "accepted route lacks complete constrained setup/hold coverage or has negative slack",
        ));
    }
    Ok(())
}

fn validate_drc(drc: &RouteDrcObservation) -> PromotionResult<()> {
    if !drc.complete_no_waivers_evaluation
        || drc.enabled_error_violations != 0
        || drc.enabled_fatal_violations != 0
        || drc.installed_waivers != 0
    {
        return Err(PromotionError::new(
            FailureCode::RouteTiming,
            "accepted route lacks a complete no-waivers DRC pass",
        ));
    }
    Ok(())
}

fn validate_resources(resources: &RouteResourceObservation) -> PromotionResult<()> {
    let fixed_caps = resources.declared_lut_cap == MAXIMUM_LUTS
        && resources.declared_register_cap == MAXIMUM_REGISTERS
        && resources.declared_dsp_cap == MAXIMUM_DSPS;
    let within_caps = resources.luts <= MAXIMUM_LUTS
        && resources.registers <= MAXIMUM_REGISTERS
        && resources.dsps <= MAXIMUM_DSPS;
    if resources.scope != ResourceScope::WholeRoutedDesignIncludingShell
        || !fixed_caps
        || !within_caps
    {
        return Err(PromotionError::new(
            FailureCode::RouteResource,
            "route resources must cover the whole routed design including shell and satisfy the fixed 200k LUT/300k register/4k DSP policy",
        ));
    }
    Ok(())
}

fn validate_nonclaims(nonclaims: &RouteNonclaims) -> PromotionResult<()> {
    if nonclaims.hardware_execution
        || nonclaims.card_validated
        || nonclaims.cryptographic_outputs_valid
        || nonclaims.performance_validated
        || nonclaims.hardware_completion_promotable
    {
        return Err(PromotionError::new(
            FailureCode::PrematureClaim,
            "route-tier input contains a premature hardware, card, cryptographic, performance, or completion claim",
        ));
    }
    Ok(())
}

fn require_strict_child(root: &str, path: &str, label: &str) -> PromotionResult<()> {
    let prefix = format!("{root}/");
    if !path.starts_with(&prefix) {
        return Err(PromotionError::new(
            FailureCode::IdentityJoin,
            format!("{label} is not beneath the exact acceptance-run root"),
        ));
    }
    Ok(())
}

fn require_same_artifact(
    expected: &RouteArtifactBinding,
    observed: &RouteArtifactBinding,
    label: &str,
) -> PromotionResult<()> {
    if expected != observed {
        return Err(PromotionError::new(
            FailureCode::IdentityJoin,
            format!("{label} does not repeat one exact artifact identity"),
        ));
    }
    Ok(())
}

fn validate_raw_report_bindings(
    acceptance_root: &str,
    inventory_reports: &[RouteArtifactBinding],
    seal_reports: &[RouteArtifactBinding],
) -> PromotionResult<()> {
    validate_raw_report_set(
        acceptance_root,
        inventory_reports,
        "run-inventory raw reports",
    )?;
    validate_raw_report_set(acceptance_root, seal_reports, "route-seal raw reports")?;
    if inventory_reports != seal_reports {
        return Err(PromotionError::new(
            FailureCode::IdentityJoin,
            "route seal does not bind the exact run-inventory raw-report set",
        ));
    }
    Ok(())
}

fn validate_raw_report_set(
    acceptance_root: &str,
    reports: &[RouteArtifactBinding],
    label: &str,
) -> PromotionResult<()> {
    if reports.is_empty() || reports.len() > MAXIMUM_RAW_ROUTE_REPORTS {
        return Err(PromotionError::new(
            FailureCode::RouteUnaccepted,
            format!("{label} must contain 1..={MAXIMUM_RAW_ROUTE_REPORTS} exact artifacts"),
        ));
    }
    let mut previous_path: Option<&str> = None;
    for (index, report) in reports.iter().enumerate() {
        report.validate(&format!("{label}[{index}]"))?;
        require_strict_child(
            acceptance_root,
            report.absolute_path(),
            &format!("{label}[{index}]"),
        )?;
        if let Some(previous) = previous_path {
            if previous == report.absolute_path() {
                return Err(PromotionError::new(
                    FailureCode::IdentityJoin,
                    format!("{label} aliases a raw-report path"),
                ));
            }
            if previous > report.absolute_path() {
                return Err(PromotionError::new(
                    FailureCode::Noncanonical,
                    format!("{label} is not strictly sorted by canonical absolute path"),
                ));
            }
        }
        previous_path = Some(report.absolute_path());
    }
    Ok(())
}

fn validate_observation_provenance(
    provenance: &RouteObservationProvenance,
    run_inventory: &RouteArtifactBinding,
    route_seal: &RouteArtifactBinding,
    raw_reports: &[RouteArtifactBinding],
    raw_report_set_sha256: &str,
    label: &str,
) -> PromotionResult<()> {
    provenance
        .run_inventory
        .validate(&format!("{label} run-inventory subject"))?;
    provenance
        .route_seal
        .validate(&format!("{label} route-seal subject"))?;
    provenance
        .source_report
        .validate(&format!("{label} source-report subject"))?;
    if !is_lower_hex(&provenance.raw_report_set_sha256, 64, true) {
        return Err(PromotionError::new(
            FailureCode::Noncanonical,
            format!("{label} has a non-canonical raw-report closure digest"),
        ));
    }
    if &provenance.run_inventory != run_inventory
        || &provenance.route_seal != route_seal
        || provenance.raw_report_set_sha256 != raw_report_set_sha256
        || !raw_reports
            .iter()
            .any(|report| report == &provenance.source_report)
    {
        return Err(PromotionError::new(
            FailureCode::IdentityJoin,
            format!(
                "{label} is not bound to the exact inventory, seal, raw-report closure, and source report"
            ),
        ));
    }
    Ok(())
}

fn canonical_raw_report_set_sha256(reports: &[RouteArtifactBinding]) -> PromotionResult<String> {
    let mut hasher = Sha256::new();
    hasher.update(REPORT_SET_DIGEST_DOMAIN);
    let report_count = u64::try_from(reports.len()).map_err(|_| {
        PromotionError::new(
            FailureCode::RouteUnaccepted,
            "raw-report set exceeds the canonical digest count boundary",
        )
    })?;
    hasher.update(report_count.to_be_bytes());
    for report in reports {
        update_artifact_subject_digest(&mut hasher, report)?;
    }
    Ok(hex_lower(&hasher.finalize()))
}

fn xclbin_identity_sha256(
    subject: &RouteArtifactBinding,
    uuid: &str,
    interface_uuid: &str,
    deployment_platform: &str,
    fpga_part: &str,
    target: &str,
) -> PromotionResult<String> {
    let mut hasher = Sha256::new();
    hasher.update(XCLBIN_IDENTITY_DIGEST_DOMAIN);
    update_artifact_subject_digest(&mut hasher, subject)?;
    for value in [uuid, interface_uuid, deployment_platform, fpga_part, target] {
        update_length_prefixed(&mut hasher, value.as_bytes())?;
    }
    Ok(hex_lower(&hasher.finalize()))
}

fn update_artifact_subject_digest(
    hasher: &mut Sha256,
    artifact: &RouteArtifactBinding,
) -> PromotionResult<()> {
    update_length_prefixed(hasher, artifact.absolute_path.as_bytes())?;
    update_length_prefixed(hasher, artifact.descriptor.canonical_realpath.as_bytes())?;
    hasher.update(artifact.bytes.to_be_bytes());
    update_length_prefixed(hasher, artifact.sha256.as_bytes())?;
    hasher.update(artifact.descriptor.device.to_be_bytes());
    hasher.update(artifact.descriptor.inode.to_be_bytes());
    Ok(())
}

fn update_length_prefixed(hasher: &mut Sha256, value: &[u8]) -> PromotionResult<()> {
    let length = u64::try_from(value.len()).map_err(|_| {
        PromotionError::new(
            FailureCode::RouteUnaccepted,
            "route evidence subject exceeds the canonical digest length boundary",
        )
    })?;
    hasher.update(length.to_be_bytes());
    hasher.update(value);
    Ok(())
}

fn require_unique_artifact_subject<'a>(
    paths: &mut BTreeSet<&'a str>,
    physical_subjects: &mut BTreeSet<(u64, u64)>,
    artifact: &'a RouteArtifactBinding,
) -> PromotionResult<()> {
    if !paths.insert(artifact.absolute_path()) {
        return Err(PromotionError::new(
            FailureCode::IdentityJoin,
            "accepted route proof lexically aliases independently bound artifacts",
        ));
    }
    if !physical_subjects.insert((artifact.descriptor.device, artifact.descriptor.inode)) {
        return Err(PromotionError::new(
            FailureCode::IdentityJoin,
            "accepted route proof aliases descriptor subjects by device and inode",
        ));
    }
    Ok(())
}

fn is_canonical_uuid(value: &str) -> bool {
    let bytes = value.as_bytes();
    bytes.len() == 36
        && bytes.iter().enumerate().all(|(index, byte)| {
            if matches!(index, 8 | 13 | 18 | 23) {
                *byte == b'-'
            } else {
                byte.is_ascii_digit() || (b'a'..=b'f').contains(byte)
            }
        })
        && bytes
            .iter()
            .enumerate()
            .any(|(index, byte)| !matches!(index, 8 | 13 | 18 | 23) && *byte != b'0')
}

#[cfg(test)]
mod tests {
    use super::*;
    use crate::model::synthetic_request;

    const XCLBIN_UUID: &str = "11111111-2222-3333-4444-555555555555";
    const INTERFACE_UUID: &str = "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee";

    fn subject(
        absolute_path: &str,
        bytes: u64,
        sha256: String,
        inode: u64,
    ) -> RouteArtifactBinding {
        RouteArtifactBinding::from_exact_parser(
            absolute_path.to_owned(),
            absolute_path.to_owned(),
            bytes,
            sha256,
            7,
            inode,
        )
    }

    fn artifact(locator: &RequestFileLocator<'_>, inode: u64) -> RouteArtifactBinding {
        subject(
            locator.absolute_path(),
            locator.bytes(),
            locator.sha256().to_owned(),
            inode,
        )
    }

    fn repeat_artifact(artifact: &RouteArtifactBinding) -> RouteArtifactBinding {
        RouteArtifactBinding::from_exact_parser(
            artifact.absolute_path.clone(),
            artifact.descriptor.canonical_realpath.clone(),
            artifact.bytes,
            artifact.sha256.clone(),
            artifact.descriptor.device,
            artifact.descriptor.inode,
        )
    }

    fn clock_artifact() -> RouteArtifactBinding {
        subject(
            "/evidence/route-acceptance/evidence/post-route-evidence.json",
            100,
            "b".repeat(64),
            30,
        )
    }

    fn xclbin_artifact() -> RouteArtifactBinding {
        subject(
            "/evidence/route-acceptance/output/kernel.xclbin",
            1_000,
            "c".repeat(64),
            40,
        )
    }

    fn raw_report_artifacts() -> Vec<RouteArtifactBinding> {
        vec![
            subject(
                "/evidence/route-acceptance/reports/report-a.raw",
                200,
                "d".repeat(64),
                20,
            ),
            subject(
                "/evidence/route-acceptance/reports/report-b.raw",
                300,
                "e".repeat(64),
                21,
            ),
        ]
    }

    fn xclbin_identity() -> RouteXclbinIdentity {
        RouteXclbinIdentity::from_exact_parser(
            xclbin_artifact(),
            XCLBIN_UUID.to_owned(),
            INTERFACE_UUID.to_owned(),
            REQUIRED_PLATFORM.to_owned(),
            REQUIRED_DEVICE_PART.to_owned(),
            REQUIRED_XCLBIN_TARGET.to_owned(),
        )
        .unwrap()
    }

    fn provenance(
        run_inventory: &RouteArtifactBinding,
        route_seal: &RouteArtifactBinding,
        raw_reports: &[RouteArtifactBinding],
        source_index: usize,
    ) -> RouteObservationProvenance {
        RouteObservationProvenance {
            run_inventory: repeat_artifact(run_inventory),
            route_seal: repeat_artifact(route_seal),
            raw_report_set_sha256: canonical_raw_report_set_sha256(raw_reports).unwrap(),
            source_report: repeat_artifact(&raw_reports[source_index]),
        }
    }

    #[allow(clippy::too_many_lines)] // Explicitly assembles every independent parser output.
    fn fixture(request: &PromotionRequest) -> RoutePolicyInputs {
        let locators = request.route_locators();
        let stage_manifest = artifact(locators.staged_run_manifest(), 1);
        let run_inventory = artifact(locators.complete_run_inventory(), 2);
        let route_seal = artifact(locators.accepted_250mhz_route_seal(), 3);
        let inventory_raw_reports = raw_report_artifacts();
        let seal_raw_reports = raw_report_artifacts();
        let routed_clock_evidence = clock_artifact();
        let xclbin_identity = xclbin_identity();
        let inventory_routed_clock_evidence = repeat_artifact(&routed_clock_evidence);
        let seal_routed_clock_evidence = repeat_artifact(&routed_clock_evidence);
        let inventory_xclbin = repeat_artifact(xclbin_identity.subject());
        let seal_xclbin = repeat_artifact(xclbin_identity.subject());
        let seal_run_inventory = repeat_artifact(&run_inventory);
        RoutePolicyInputs {
            identity: BoundRouteObservation {
                provenance: provenance(&run_inventory, &route_seal, &inventory_raw_reports, 0),
                value: RouteIdentityObservation {
                    evidence_tier: ACCEPTANCE_EVIDENCE_TIER.to_owned(),
                    capture_kind: ACCEPTANCE_CAPTURE_KIND.to_owned(),
                    status: ACCEPTANCE_STATUS.to_owned(),
                    profile: PERFORMANCE_PROFILE.to_owned(),
                    amd_release: REQUIRED_AMD_RELEASE.to_owned(),
                    deployment_platform: REQUIRED_PLATFORM.to_owned(),
                    device_part: REQUIRED_DEVICE_PART.to_owned(),
                    route_design_digest: "a".repeat(64),
                    requested_clock_hz: BASELINE_CLOCK_HZ,
                    actual_routed_hz: BASELINE_CLOCK_HZ,
                },
            },
            stage_identity: StageManifestIdentityObservation {
                source: repeat_artifact(&stage_manifest),
                route_provenance: provenance(
                    &run_inventory,
                    &route_seal,
                    &inventory_raw_reports,
                    0,
                ),
                stage_subject_sha256: locators.staged_run_manifest().sha256().to_owned(),
                design_digest: "a".repeat(64),
            },
            inventory_identity: RunInventoryIdentityObservation {
                source: repeat_artifact(&run_inventory),
                route_provenance: provenance(
                    &run_inventory,
                    &route_seal,
                    &inventory_raw_reports,
                    0,
                ),
                stage_subject_sha256: locators.staged_run_manifest().sha256().to_owned(),
                design_digest: "a".repeat(64),
            },
            status: BoundRouteObservation {
                provenance: provenance(&run_inventory, &route_seal, &inventory_raw_reports, 0),
                value: RouteStatusObservation {
                    placed_fully: true,
                    routed_fully: true,
                    partially_routed: false,
                    route_errors: false,
                },
            },
            timing: BoundRouteObservation {
                provenance: provenance(&run_inventory, &route_seal, &inventory_raw_reports, 0),
                value: RouteTimingObservation {
                    setup_wns_femtoseconds: 0,
                    hold_whs_femtoseconds: 0,
                    setup_path_count: 1,
                    hold_path_count: 1,
                    unconstrained_path_count: 0,
                    unconstrained_endpoint_count: 0,
                    complete_timing_coverage: true,
                },
            },
            drc: BoundRouteObservation {
                provenance: provenance(&run_inventory, &route_seal, &inventory_raw_reports, 1),
                value: RouteDrcObservation {
                    complete_no_waivers_evaluation: true,
                    enabled_error_violations: 0,
                    enabled_fatal_violations: 0,
                    installed_waivers: 0,
                },
            },
            resources: BoundRouteObservation {
                provenance: provenance(&run_inventory, &route_seal, &inventory_raw_reports, 1),
                value: RouteResourceObservation {
                    scope: ResourceScope::WholeRoutedDesignIncludingShell,
                    luts: MAXIMUM_LUTS,
                    registers: MAXIMUM_REGISTERS,
                    dsps: MAXIMUM_DSPS,
                    declared_lut_cap: MAXIMUM_LUTS,
                    declared_register_cap: MAXIMUM_REGISTERS,
                    declared_dsp_cap: MAXIMUM_DSPS,
                },
            },
            nonclaims: RouteNonclaims {
                hardware_execution: false,
                card_validated: false,
                cryptographic_outputs_valid: false,
                performance_validated: false,
                hardware_completion_promotable: false,
            },
            stage_manifest,
            run_inventory,
            route_seal,
            inventory_raw_reports,
            seal_raw_reports,
            routed_clock_evidence,
            xclbin_identity,
            inventory_routed_clock_evidence,
            inventory_xclbin,
            seal_run_inventory,
            seal_routed_clock_evidence,
            seal_xclbin,
        }
    }

    #[allow(clippy::large_types_passed_by_value)] // The validator consumes parser output.
    fn assert_rejected(input: RoutePolicyInputs, code: FailureCode) {
        let request = synthetic_request(&"1".repeat(32));
        assert_eq!(
            validate_route_policy_inputs(&request, input)
                .expect_err("mutated route proof must fail closed")
                .code(),
            code
        );
    }

    #[test]
    fn exact_policy_boundary_produces_metadata_not_accepted_evidence() {
        let request = synthetic_request(&"1".repeat(32));
        let policy = validate_route_policy_inputs(&request, fixture(&request)).unwrap();
        assert_eq!(policy.design_digest, "a".repeat(64));
        assert_eq!(policy.actual_routed_hz, BASELINE_CLOCK_HZ);
        assert_eq!(policy.setup_wns_femtoseconds, 0);
        assert_eq!(policy.hold_whs_femtoseconds, 0);
        assert_eq!(policy.whole_design_luts, MAXIMUM_LUTS);
        assert_eq!(policy.whole_design_registers, MAXIMUM_REGISTERS);
        assert_eq!(policy.whole_design_dsps, MAXIMUM_DSPS);
        assert_eq!(policy.raw_reports.len(), 2);
        assert_eq!(policy.raw_reports[0].sha256(), "d".repeat(64));
        assert_eq!(policy.xclbin_identity.subject().bytes(), 1_000);
        assert_eq!(policy.xclbin_identity.subject().sha256(), "c".repeat(64));
        assert_eq!(
            policy.xclbin_identity.subject().canonical_realpath(),
            "/evidence/route-acceptance/output/kernel.xclbin"
        );
        assert_eq!(policy.xclbin_identity.subject().device(), 7);
        assert_eq!(policy.xclbin_identity.subject().inode(), 40);
        assert_eq!(policy.xclbin_identity.uuid(), XCLBIN_UUID);
        assert_eq!(policy.xclbin_identity.interface_uuid(), INTERFACE_UUID);
        assert_eq!(
            policy.xclbin_identity.deployment_platform(),
            REQUIRED_PLATFORM
        );
        assert_eq!(policy.xclbin_identity.fpga_part(), REQUIRED_DEVICE_PART);
        assert_eq!(policy.xclbin_identity.target(), REQUIRED_XCLBIN_TARGET);
    }

    #[test]
    fn routed_clock_above_the_baseline_remains_acceptable() {
        let request = synthetic_request(&"1".repeat(32));
        let mut input = fixture(&request);
        input.identity.value.actual_routed_hz = BASELINE_CLOCK_HZ + 1;
        let policy = validate_route_policy_inputs(&request, input).unwrap();
        assert_eq!(policy.actual_routed_hz, BASELINE_CLOCK_HZ + 1);
    }

    #[test]
    fn public_route_entry_remains_unreachable() {
        let request = synthetic_request(&"1".repeat(32));
        assert_eq!(
            require_accepted_route(&request).unwrap_err().code(),
            FailureCode::RouteUnaccepted
        );
    }

    #[test]
    fn identity_mutations_fail_before_route_acceptance() {
        let request = synthetic_request(&"1".repeat(32));

        let mut wrong_tier = fixture(&request);
        wrong_tier.identity.value.evidence_tier = "format-probe-capture".to_owned();
        assert_rejected(wrong_tier, FailureCode::RouteUnaccepted);

        let mut wrong_capture = fixture(&request);
        wrong_capture.identity.value.capture_kind = "format-probe-capture".to_owned();
        assert_rejected(wrong_capture, FailureCode::RouteUnaccepted);

        let mut failed_status = fixture(&request);
        failed_status.identity.value.status = "failed".to_owned();
        assert_rejected(failed_status, FailureCode::RouteUnaccepted);

        let mut wrong_profile = fixture(&request);
        wrong_profile.identity.value.profile = "LEGACY_KECCAK".to_owned();
        assert_rejected(wrong_profile, FailureCode::RouteUnaccepted);

        let mut wrong_release = fixture(&request);
        wrong_release.identity.value.amd_release = "2024.1".to_owned();
        assert_rejected(wrong_release, FailureCode::RouteUnaccepted);

        let mut wrong_platform = fixture(&request);
        wrong_platform.identity.value.deployment_platform = "other-platform".to_owned();
        assert_rejected(wrong_platform, FailureCode::RouteUnaccepted);

        let mut wrong_part = fixture(&request);
        wrong_part.identity.value.device_part = "other-part".to_owned();
        assert_rejected(wrong_part, FailureCode::RouteUnaccepted);

        let mut zero_design = fixture(&request);
        zero_design.identity.value.route_design_digest = "0".repeat(64);
        assert_rejected(zero_design, FailureCode::RouteUnaccepted);

        let mut mismatched_design = fixture(&request);
        mismatched_design.identity.value.route_design_digest = "d".repeat(64);
        assert_rejected(mismatched_design, FailureCode::IdentityJoin);

        let mut changed_stage_subject = fixture(&request);
        changed_stage_subject.stage_identity.stage_subject_sha256 = "d".repeat(64);
        assert_rejected(changed_stage_subject, FailureCode::IdentityJoin);

        let mut changed_inventory_subject = fixture(&request);
        changed_inventory_subject
            .inventory_identity
            .stage_subject_sha256 = "d".repeat(64);
        assert_rejected(changed_inventory_subject, FailureCode::IdentityJoin);

        let mut changed_stage_design = fixture(&request);
        changed_stage_design.stage_identity.design_digest = "d".repeat(64);
        assert_rejected(changed_stage_design, FailureCode::IdentityJoin);

        let mut changed_inventory_design = fixture(&request);
        changed_inventory_design.inventory_identity.design_digest = "d".repeat(64);
        assert_rejected(changed_inventory_design, FailureCode::IdentityJoin);

        let mut noncanonical_stage_subject = fixture(&request);
        noncanonical_stage_subject
            .stage_identity
            .stage_subject_sha256 = "0".repeat(64);
        assert_rejected(noncanonical_stage_subject, FailureCode::Noncanonical);

        let mut probe_clock = fixture(&request);
        probe_clock.identity.value.requested_clock_hz = 300_000_000;
        assert_rejected(probe_clock, FailureCode::RouteUnaccepted);

        let mut slow_route = fixture(&request);
        slow_route.identity.value.actual_routed_hz = BASELINE_CLOCK_HZ - 1;
        assert_rejected(slow_route, FailureCode::RouteTiming);
    }

    #[test]
    fn every_parsed_observation_rejects_subject_or_closure_splicing() {
        let request = synthetic_request(&"1".repeat(32));

        let mut identity_inventory_splice = fixture(&request);
        identity_inventory_splice
            .identity
            .provenance
            .run_inventory
            .sha256 = "f".repeat(64);
        assert_rejected(identity_inventory_splice, FailureCode::IdentityJoin);

        let mut status_source_splice = fixture(&request);
        status_source_splice.status.provenance.source_report = xclbin_artifact();
        assert_rejected(status_source_splice, FailureCode::IdentityJoin);

        let mut timing_seal_splice = fixture(&request);
        timing_seal_splice.timing.provenance.route_seal.bytes += 1;
        assert_rejected(timing_seal_splice, FailureCode::IdentityJoin);

        let mut timing_same_bytes_other_route = fixture(&request);
        timing_same_bytes_other_route
            .timing
            .provenance
            .source_report
            .descriptor
            .inode += 100;
        assert_rejected(timing_same_bytes_other_route, FailureCode::IdentityJoin);

        let mut drc_closure_splice = fixture(&request);
        drc_closure_splice.drc.provenance.raw_report_set_sha256 = "f".repeat(64);
        assert_rejected(drc_closure_splice, FailureCode::IdentityJoin);

        let mut resource_source_splice = fixture(&request);
        resource_source_splice.resources.provenance.source_report = subject(
            "/evidence/route-acceptance/reports/other-report.raw",
            400,
            "f".repeat(64),
            22,
        );
        assert_rejected(resource_source_splice, FailureCode::IdentityJoin);

        let mut stage_source_splice = fixture(&request);
        let inventory_subject = repeat_artifact(&stage_source_splice.run_inventory);
        stage_source_splice.stage_identity.source = inventory_subject;
        assert_rejected(stage_source_splice, FailureCode::IdentityJoin);

        let mut stage_closure_splice = fixture(&request);
        stage_closure_splice
            .stage_identity
            .route_provenance
            .raw_report_set_sha256 = "f".repeat(64);
        assert_rejected(stage_closure_splice, FailureCode::IdentityJoin);

        let mut inventory_source_splice = fixture(&request);
        let stage_subject = repeat_artifact(&inventory_source_splice.stage_manifest);
        inventory_source_splice.inventory_identity.source = stage_subject;
        assert_rejected(inventory_source_splice, FailureCode::IdentityJoin);
    }

    #[test]
    fn incomplete_route_timing_and_drc_fail_closed() {
        let request = synthetic_request(&"1".repeat(32));

        let mut partial = fixture(&request);
        partial.status.value.partially_routed = true;
        assert_rejected(partial, FailureCode::RouteTiming);

        let mut unplaced = fixture(&request);
        unplaced.status.value.placed_fully = false;
        assert_rejected(unplaced, FailureCode::RouteTiming);

        let mut unrouted = fixture(&request);
        unrouted.status.value.routed_fully = false;
        assert_rejected(unrouted, FailureCode::RouteTiming);

        let mut route_error = fixture(&request);
        route_error.status.value.route_errors = true;
        assert_rejected(route_error, FailureCode::RouteTiming);

        let mut negative_setup = fixture(&request);
        negative_setup.timing.value.setup_wns_femtoseconds = -1;
        assert_rejected(negative_setup, FailureCode::RouteTiming);

        let mut negative_hold = fixture(&request);
        negative_hold.timing.value.hold_whs_femtoseconds = -1;
        assert_rejected(negative_hold, FailureCode::RouteTiming);

        let mut incomplete_coverage = fixture(&request);
        incomplete_coverage.timing.value.complete_timing_coverage = false;
        assert_rejected(incomplete_coverage, FailureCode::RouteTiming);

        let mut missing_hold = fixture(&request);
        missing_hold.timing.value.hold_path_count = 0;
        assert_rejected(missing_hold, FailureCode::RouteTiming);

        let mut missing_setup = fixture(&request);
        missing_setup.timing.value.setup_path_count = 0;
        assert_rejected(missing_setup, FailureCode::RouteTiming);

        let mut unconstrained = fixture(&request);
        unconstrained.timing.value.unconstrained_endpoint_count = 1;
        assert_rejected(unconstrained, FailureCode::RouteTiming);

        let mut unconstrained_path = fixture(&request);
        unconstrained_path.timing.value.unconstrained_path_count = 1;
        assert_rejected(unconstrained_path, FailureCode::RouteTiming);

        let mut incomplete_drc = fixture(&request);
        incomplete_drc.drc.value.complete_no_waivers_evaluation = false;
        assert_rejected(incomplete_drc, FailureCode::RouteTiming);

        let mut waived = fixture(&request);
        waived.drc.value.installed_waivers = 1;
        assert_rejected(waived, FailureCode::RouteTiming);

        let mut error = fixture(&request);
        error.drc.value.enabled_error_violations = 1;
        assert_rejected(error, FailureCode::RouteTiming);

        let mut fatal = fixture(&request);
        fatal.drc.value.enabled_fatal_violations = 1;
        assert_rejected(fatal, FailureCode::RouteTiming);
    }

    #[test]
    fn kernel_only_relaxed_or_over_limit_resources_fail_closed() {
        let request = synthetic_request(&"1".repeat(32));

        let mut kernel_only = fixture(&request);
        kernel_only.resources.value.scope = ResourceScope::KernelHierarchyOnly;
        assert_rejected(kernel_only, FailureCode::RouteResource);

        let mut relaxed_cap = fixture(&request);
        relaxed_cap.resources.value.declared_dsp_cap = MAXIMUM_DSPS + 1;
        assert_rejected(relaxed_cap, FailureCode::RouteResource);

        let mut relaxed_lut_cap = fixture(&request);
        relaxed_lut_cap.resources.value.declared_lut_cap = MAXIMUM_LUTS + 1;
        assert_rejected(relaxed_lut_cap, FailureCode::RouteResource);

        let mut relaxed_register_cap = fixture(&request);
        relaxed_register_cap.resources.value.declared_register_cap = MAXIMUM_REGISTERS + 1;
        assert_rejected(relaxed_register_cap, FailureCode::RouteResource);

        let mut excess_lut = fixture(&request);
        excess_lut.resources.value.luts = MAXIMUM_LUTS + 1;
        assert_rejected(excess_lut, FailureCode::RouteResource);

        let mut excess_register = fixture(&request);
        excess_register.resources.value.registers = MAXIMUM_REGISTERS + 1;
        assert_rejected(excess_register, FailureCode::RouteResource);

        let mut excess_dsp = fixture(&request);
        excess_dsp.resources.value.dsps = MAXIMUM_DSPS + 1;
        assert_rejected(excess_dsp, FailureCode::RouteResource);
    }

    #[test]
    fn artifact_splices_aliases_and_noncanonical_bindings_fail_closed() {
        let request = synthetic_request(&"1".repeat(32));

        let mut changed_inventory = fixture(&request);
        changed_inventory.run_inventory.sha256 = "d".repeat(64);
        assert_rejected(changed_inventory, FailureCode::IdentityJoin);

        let mut changed_stage = fixture(&request);
        changed_stage.stage_manifest.bytes += 1;
        assert_rejected(changed_stage, FailureCode::IdentityJoin);

        let mut changed_seal = fixture(&request);
        changed_seal.route_seal.sha256 = "e".repeat(64);
        assert_rejected(changed_seal, FailureCode::IdentityJoin);

        let mut inventory_xclbin_splice = fixture(&request);
        inventory_xclbin_splice.inventory_xclbin.sha256 = "d".repeat(64);
        assert_rejected(inventory_xclbin_splice, FailureCode::IdentityJoin);

        let mut inventory_clock_splice = fixture(&request);
        inventory_clock_splice
            .inventory_routed_clock_evidence
            .sha256 = "d".repeat(64);
        assert_rejected(inventory_clock_splice, FailureCode::IdentityJoin);

        let mut seal_clock_splice = fixture(&request);
        seal_clock_splice.seal_routed_clock_evidence.bytes += 1;
        assert_rejected(seal_clock_splice, FailureCode::IdentityJoin);

        let mut seal_inventory_splice = fixture(&request);
        seal_inventory_splice.seal_run_inventory.sha256 = "e".repeat(64);
        assert_rejected(seal_inventory_splice, FailureCode::IdentityJoin);

        let mut seal_xclbin_splice = fixture(&request);
        seal_xclbin_splice.seal_xclbin.bytes += 1;
        assert_rejected(seal_xclbin_splice, FailureCode::IdentityJoin);

        let mut outside_root = fixture(&request);
        outside_root.xclbin_identity.subject.absolute_path = "/other/kernel.xclbin".to_owned();
        assert_rejected(outside_root, FailureCode::IdentityJoin);

        let mut clock_outside_root = fixture(&request);
        clock_outside_root.routed_clock_evidence.absolute_path =
            "/other/post-route-evidence.json".to_owned();
        assert_rejected(clock_outside_root, FailureCode::IdentityJoin);

        let mut alias = fixture(&request);
        alias.routed_clock_evidence = xclbin_artifact();
        alias.inventory_routed_clock_evidence = xclbin_artifact();
        alias.seal_routed_clock_evidence = xclbin_artifact();
        assert_rejected(alias, FailureCode::IdentityJoin);

        let mut zero_length = fixture(&request);
        zero_length.xclbin_identity.subject.bytes = 0;
        assert_rejected(zero_length, FailureCode::Noncanonical);

        let mut uppercase_digest = fixture(&request);
        uppercase_digest.xclbin_identity.subject.sha256 = "A".repeat(64);
        assert_rejected(uppercase_digest, FailureCode::Noncanonical);
    }

    #[test]
    fn parser_derived_symlink_realpath_and_hardlink_aliases_fail_closed() {
        let request = synthetic_request(&"1".repeat(32));

        // A symlinked pathname resolves to a different canonical realpath.
        let mut realpath_alias = fixture(&request);
        realpath_alias
            .routed_clock_evidence
            .descriptor
            .canonical_realpath = "/evidence/route-acceptance/evidence/other-clock.json".to_owned();
        assert_rejected(realpath_alias, FailureCode::IdentityJoin);

        let mut hardlink_alias = fixture(&request);
        let xclbin_device = hardlink_alias.xclbin_identity.subject.descriptor.device;
        let xclbin_inode = hardlink_alias.xclbin_identity.subject.descriptor.inode;
        hardlink_alias.inventory_raw_reports[0].descriptor.device = xclbin_device;
        hardlink_alias.inventory_raw_reports[0].descriptor.inode = xclbin_inode;
        hardlink_alias.seal_raw_reports[0].descriptor.device = xclbin_device;
        hardlink_alias.seal_raw_reports[0].descriptor.inode = xclbin_inode;
        assert_rejected(hardlink_alias, FailureCode::IdentityJoin);

        let mut missing_inode = fixture(&request);
        missing_inode.route_seal.descriptor.inode = 0;
        assert_rejected(missing_inode, FailureCode::Noncanonical);
    }

    #[test]
    fn raw_report_omissions_splices_ordering_and_aliases_fail_closed() {
        let request = synthetic_request(&"1".repeat(32));

        let mut empty = fixture(&request);
        empty.inventory_raw_reports.clear();
        empty.seal_raw_reports.clear();
        assert_rejected(empty, FailureCode::RouteUnaccepted);

        let mut unsorted = fixture(&request);
        unsorted.inventory_raw_reports.swap(0, 1);
        unsorted.seal_raw_reports.swap(0, 1);
        assert_rejected(unsorted, FailureCode::Noncanonical);

        let mut duplicate = fixture(&request);
        let duplicate_path = duplicate.inventory_raw_reports[0].absolute_path.clone();
        duplicate.inventory_raw_reports[1].absolute_path = duplicate_path.clone();
        duplicate.inventory_raw_reports[1]
            .descriptor
            .canonical_realpath = duplicate_path.clone();
        duplicate.seal_raw_reports[1].absolute_path = duplicate_path.clone();
        duplicate.seal_raw_reports[1].descriptor.canonical_realpath = duplicate_path;
        assert_rejected(duplicate, FailureCode::IdentityJoin);

        let mut outside_root = fixture(&request);
        outside_root.inventory_raw_reports[0].absolute_path = "/other/report-a.raw".to_owned();
        outside_root.inventory_raw_reports[0]
            .descriptor
            .canonical_realpath = "/other/report-a.raw".to_owned();
        outside_root.seal_raw_reports[0].absolute_path = "/other/report-a.raw".to_owned();
        outside_root.seal_raw_reports[0]
            .descriptor
            .canonical_realpath = "/other/report-a.raw".to_owned();
        assert_rejected(outside_root, FailureCode::IdentityJoin);

        let mut seal_digest_splice = fixture(&request);
        seal_digest_splice.seal_raw_reports[0].sha256 = "f".repeat(64);
        assert_rejected(seal_digest_splice, FailureCode::IdentityJoin);

        let mut primary_alias = fixture(&request);
        primary_alias.inventory_raw_reports[0] = xclbin_artifact();
        primary_alias.seal_raw_reports[0] = xclbin_artifact();
        assert_rejected(primary_alias, FailureCode::IdentityJoin);

        let mut zero_length = fixture(&request);
        zero_length.inventory_raw_reports[0].bytes = 0;
        zero_length.seal_raw_reports[0].bytes = 0;
        assert_rejected(zero_length, FailureCode::Noncanonical);
    }

    #[test]
    fn xclbin_identity_mutations_fail_closed() {
        let request = synthetic_request(&"1".repeat(32));

        let mut uppercase_uuid = fixture(&request);
        uppercase_uuid.xclbin_identity.uuid = XCLBIN_UUID.to_ascii_uppercase();
        assert_rejected(uppercase_uuid, FailureCode::Noncanonical);

        let mut canonical_uuid_substitution = fixture(&request);
        canonical_uuid_substitution.xclbin_identity.uuid =
            "22222222-3333-4444-5555-666666666666".to_owned();
        assert_rejected(canonical_uuid_substitution, FailureCode::IdentityJoin);

        let mut zero_interface_uuid = fixture(&request);
        zero_interface_uuid.xclbin_identity.interface_uuid =
            "00000000-0000-0000-0000-000000000000".to_owned();
        assert_rejected(zero_interface_uuid, FailureCode::Noncanonical);

        let mut canonical_interface_substitution = fixture(&request);
        canonical_interface_substitution
            .xclbin_identity
            .interface_uuid = "bbbbbbbb-cccc-dddd-eeee-ffffffffffff".to_owned();
        assert_rejected(canonical_interface_substitution, FailureCode::IdentityJoin);

        let mut wrong_platform = fixture(&request);
        wrong_platform.xclbin_identity.deployment_platform = "other-platform".to_owned();
        assert_rejected(wrong_platform, FailureCode::IdentityJoin);

        let mut wrong_part = fixture(&request);
        wrong_part.xclbin_identity.fpga_part = "other-part".to_owned();
        assert_rejected(wrong_part, FailureCode::IdentityJoin);

        let mut wrong_target = fixture(&request);
        wrong_target.xclbin_identity.target = "hw_emu".to_owned();
        assert_rejected(wrong_target, FailureCode::RouteUnaccepted);

        let mut subject_splice = fixture(&request);
        subject_splice.xclbin_identity = RouteXclbinIdentity::from_exact_parser(
            subject(
                "/evidence/route-acceptance/output/other-kernel.xclbin",
                1_001,
                "f".repeat(64),
                41,
            ),
            XCLBIN_UUID.to_owned(),
            INTERFACE_UUID.to_owned(),
            REQUIRED_PLATFORM.to_owned(),
            REQUIRED_DEVICE_PART.to_owned(),
            REQUIRED_XCLBIN_TARGET.to_owned(),
        )
        .unwrap();
        assert_rejected(subject_splice, FailureCode::IdentityJoin);
    }

    #[test]
    fn route_tier_cannot_prepopulate_any_terminal_claim() {
        let request = synthetic_request(&"1".repeat(32));

        let mut hardware = fixture(&request);
        hardware.nonclaims.hardware_execution = true;
        assert_rejected(hardware, FailureCode::PrematureClaim);

        let mut card = fixture(&request);
        card.nonclaims.card_validated = true;
        assert_rejected(card, FailureCode::PrematureClaim);

        let mut crypto = fixture(&request);
        crypto.nonclaims.cryptographic_outputs_valid = true;
        assert_rejected(crypto, FailureCode::PrematureClaim);

        let mut performance = fixture(&request);
        performance.nonclaims.performance_validated = true;
        assert_rejected(performance, FailureCode::PrematureClaim);

        let mut completion = fixture(&request);
        completion.nonclaims.hardware_completion_promotable = true;
        assert_rejected(completion, FailureCode::PrematureClaim);
    }
}