Proposal Is Not Permission: Writing a Fail-Closed Realization Kernel in Pure Rust (Where Time Only Moves on Commit)

//! KY Engine v1 (κ_27) — Fail-Closed Meta-Engine Kernel with Typed Verdict & Causal Time (τ)
//! Authority: NONE | Typed Law:
//!   x̃_{t+1} = Π_K(Φ(x_t))
//!   d_{t+1} = Ω(x̃_{t+1}, π, g, h) ∈ {OPEN, HOLD, KILL}
//!   x_{t+1} = x̃_{t+1} (OPEN) | x_t (HOLD) | ⊥ (KILL)
//!   τ_{t+1} = τ_t + 1 (OPEN) | τ_t (HOLD, KILL)

use std::collections::HashMap;

#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum LifecycleState {
    Raw,       // ○
    Estimate,  // ◇
    Struct,    // □
    Viability, // ⬡
    Committed, // ◉
}

#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum GateStatus {
    Open,
    Hold,
    Kill,
}

#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum FailureCode {
    None,
    IllegalStateTransition,
    SyntaxError,
    StructureInvalid,
    HashChainBroken,
    Inadmissible,
    AuditFailed,
    NonReproducible,
    IksReversibilityFailed,
    RosettaIdentityDrift,
    NashCollapse,
    NashRegularizableResidual,
    EtorRiskExceeded,
    PostCausalBoundaryCrossed,
    HighUncertainty,
}

/// Verdict is not dynamics: Ω returns a pure decision (d_{t+1}), not a state.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub struct GateVerdict {
    pub decision: GateStatus,
    pub reason: FailureCode,
}

#[derive(Debug, Clone)]
pub struct Record {
    pub object_id: u64,
    pub payload: String,
    pub lifecycle_state: LifecycleState,
    pub gate_status: GateStatus,
    pub structure_valid: bool,
    pub admissibility_flag: bool,
    pub audit_required: bool,
    pub audit_pass: bool,
    pub reproducible: bool,
    pub iks_reversible: bool,        // F(F(s)) == s
    pub rosetta_identity_ok: bool,   // Identity preservation across layers
    pub etor_risk_pi: f64,           // Epistemic risk π
    pub etor_threshold_tau: f64,     // Threshold τ (π >= τ => disabled)
    pub pre_commit_g: f64,           // Pre-commit boundary g(x) < 0
    pub clamped_amplitude: f64,      // clamp01(amplitude) ∈ [0.0, 1.0]
    pub uncertainty_high: bool,
    pub failure_code: FailureCode,
    pub integrity_hash: u64,
    pub or_fuse_latch: u64,          // P_{t+1} = P_t ∨ Δ_t (monotonic OR-fuse)
    pub tau_coord: u64,              // Causal time coordinate (τ) at realization
}

#[derive(Debug, Clone)]
pub struct WitnessEvent {
    pub event_id: u64,
    pub object_id: u64,
    pub prev_hash: u64,
    pub event_hash: u64,
    pub operation: &'static str,
    pub result: GateStatus,
    pub reason_code: FailureCode,
    pub timestamp: u64, // Wall-clock tick (t)
    pub tau_coord: u64, // Causal time coordinate (τ)
}

/// Clamping = amplitude control before meaning: forces raw values into [0, 1].
pub fn clamp01(val: f64) -> f64 {
    if val.is_nan() || val < 0.0 {
        0.0
    } else if val > 1.0 {
        1.0
    } else {
        val
    }
}

/// Reversible phase (XOR: ⊕) vs. Irreversible commit (OR-fuse: ∨)
pub struct PhaseCommitLogic;

impl PhaseCommitLogic {
    /// ⊕ = reversible phase/mask: (a ⊕ b) ⊕ b == a
    pub fn xor_reversible_phase(state_mask: u64, delta_mask: u64) -> u64 {
        state_mask ^ delta_mask
    }

    /// ∨ = irreversible commit (OR-fuse): P_{t+1} = P_t ∨ Δ_t with P_{t+1} ⊇ P_t
    pub fn or_fuse_commit(prev_latch: u64, delta_mask: u64) -> u64 {
        prev_latch | delta_mask
    }
}

/// IKS: Reversibility is the property. IKS is the test: F(F(s)) == s.
pub struct IksCoherenceTest;

impl IksCoherenceTest {
    pub fn involution_transform(s: &str) -> String {
        s.chars().rev().collect()
    }

    pub fn verify_roundtrip(s: &str) -> bool {
        let f_s = Self::involution_transform(s);
        let f_f_s = Self::involution_transform(&f_s);
        f_f_s == s
    }
}

/// Operational Nash Operator: N(x) = (r_BR(x), r_embed(x), r_tame(x), r_curv(g))
#[derive(Debug, Clone, Copy)]
pub struct NashResidual {
    pub r_br: f64,
    pub r_embed: f64,
    pub r_tame: f64,
    pub r_curv: f64,
}

impl NashResidual {
    pub fn norm(&self) -> f64 {
        (self.r_br * self.r_br
            + self.r_embed * self.r_embed
            + self.r_tame * self.r_tame
            + self.r_curv * self.r_curv)
            .sqrt()
    }

    /// Nash–Moser smoothing operator (S_λ): tames derivative noise in HOLD zone
    pub fn smooth_s_lambda(&self, lambda: f64) -> Self {
        let factor = 1.0 / (1.0 + lambda.max(0.0));
        Self {
            r_br: self.r_br * factor,
            r_embed: self.r_embed * factor,
            r_tame: self.r_tame * factor,
            r_curv: self.r_curv * factor,
        }
    }
}

pub struct NashGate;

impl NashGate {
    pub fn evaluate(residual: &NashResidual, eps: f64, tau: f64, regularizable: bool) -> GateVerdict {
        let n = residual.norm();
        if n <= eps {
            GateVerdict {
                decision: GateStatus::Open,
                reason: FailureCode::None,
            }
        } else if n <= tau && regularizable {
            GateVerdict {
                decision: GateStatus::Hold,
                reason: FailureCode::NashRegularizableResidual,
            }
        } else {
            GateVerdict {
                decision: GateStatus::Kill,
                reason: FailureCode::NashCollapse,
            }
        }
    }

    /// 2x2 Nash best-response verification
    pub fn verify_2x2_best_response(u1: [[i32; 2]; 2], u2: [[i32; 2]; 2], s1: usize, s2: usize) -> GateStatus {
        let other_s1 = 1 - s1;
        let other_s2 = 1 - s2;
        let p1_best = u1[s1][s2] >= u1[other_s1][s2];
        let p2_best = u2[s1][s2] >= u2[s1][other_s2];
        if p1_best && p2_best {
            GateStatus::Open
        } else {
            GateStatus::Kill
        }
    }
}

pub struct RawInput {
    pub object_id: u64,
    pub expression: String,
    pub audit_flag: bool,        // #
    pub irreversible_flag: bool, // !
    pub execute_flag: bool,      // ▶
}

pub struct Parser;

impl Parser {
    pub fn parse(object_id: u64, input: &str) -> Result<RawInput, FailureCode> {
        let trimmed = input.trim();
        if trimmed.is_empty() {
            return Err(FailureCode::SyntaxError);
        }
        let audit_flag = trimmed.contains('#');
        let irreversible_flag = trimmed.contains('!');
        let execute_flag = trimmed.contains('▶');
        if !execute_flag {
            return Err(FailureCode::SyntaxError);
        }
        Ok(RawInput {
            object_id,
            expression: trimmed.to_string(),
            audit_flag,
            irreversible_flag,
            execute_flag,
        })
    }
}

pub struct Typechecker;

impl Typechecker {
    /// Only ○ -> ◇ -> □ -> ⬡ -> ◉ is allowed. Direct (○ -> ◉) is a forbidden short-circuit (KILL).
    pub fn verify_transition(from: LifecycleState, to: LifecycleState) -> Result<LifecycleState, FailureCode> {
        match (from, to) {
            (LifecycleState::Raw, LifecycleState::Estimate) => Ok(to),
            (LifecycleState::Estimate, LifecycleState::Struct) => Ok(to),
            (LifecycleState::Struct, LifecycleState::Viability) => Ok(to),
            (LifecycleState::Viability, LifecycleState::Committed) => Ok(to),
            _ => Err(FailureCode::IllegalStateTransition),
        }
    }
}

pub struct GeneratorPhi;

impl GeneratorPhi {
    pub fn generate(raw: RawInput, current_tau: u64) -> Result<Record, FailureCode> {
        let next_state = Typechecker::verify_transition(
            LifecycleState::Raw,
            LifecycleState::Estimate,
        )?;

        Ok(Record {
            object_id: raw.object_id,
            payload: raw.expression,
            lifecycle_state: next_state,
            gate_status: GateStatus::Hold,
            structure_valid: false,
            admissibility_flag: false,
            audit_required: raw.audit_flag,
            audit_pass: false,
            reproducible: false,
            iks_reversible: false,
            rosetta_identity_ok: false,
            etor_risk_pi: 0.0,
            etor_threshold_tau: 0.5,
            pre_commit_g: -1.0,
            clamped_amplitude: clamp01(0.5),
            uncertainty_high: false,
            failure_code: FailureCode::None,
            integrity_hash: 0,
            or_fuse_latch: 0,
            tau_coord: current_tau,
        })
    }
}

pub trait WorldRules {
    fn check_structure(&self, payload: &str) -> bool;
    fn check_admissibility(&self, payload: &str) -> bool;
    fn check_audit(&self, payload: &str) -> bool;
    fn check_reproducible(&self, payload: &str) -> bool;
    fn check_uncertainty(&self, payload: &str) -> bool;
    fn check_rosetta_identity(&self, _payload: &str) -> bool {
        true
    }
    fn compute_etor_risk_pi(&self, payload: &str) -> f64 {
        if self.check_uncertainty(payload) { 0.75 } else { 0.10 }
    }
    fn compute_pre_commit_g(&self, _payload: &str) -> f64 {
        -1.0
    }
}

pub struct ProjectorPi;

impl ProjectorPi {
    pub fn project<R: WorldRules>(
        mut candidate: Record,
        rules: &R,
        prev_hash: u64,
    ) -> Result<Record, FailureCode> {
        candidate.lifecycle_state = Typechecker::verify_transition(
            candidate.lifecycle_state,
            LifecycleState::Struct,
        )?;
        candidate.structure_valid = rules.check_structure(&candidate.payload);

        candidate.lifecycle_state = Typechecker::verify_transition(
            candidate.lifecycle_state,
            LifecycleState::Viability,
        )?;
        candidate.admissibility_flag = rules.check_admissibility(&candidate.payload);
        candidate.audit_pass = if candidate.audit_required {
            rules.check_audit(&candidate.payload)
        } else {
            true
        };
        candidate.reproducible = rules.check_reproducible(&candidate.payload);
        candidate.iks_reversible = IksCoherenceTest::verify_roundtrip(&candidate.payload);
        candidate.rosetta_identity_ok = rules.check_rosetta_identity(&candidate.payload);
        candidate.etor_risk_pi = rules.compute_etor_risk_pi(&candidate.payload);
        candidate.pre_commit_g = rules.compute_pre_commit_g(&candidate.payload);
        candidate.uncertainty_high = rules.check_uncertainty(&candidate.payload);
        candidate.integrity_hash = Self::compute_hash(prev_hash, candidate.object_id, &candidate.payload);

        Ok(candidate)
    }

    pub fn compute_hash(prev_hash: u64, id: u64, payload: &str) -> u64 {
        let mut hash: u64 = 0xcbf29ce484222325;
        for b in prev_hash.to_le_bytes().iter().chain(id.to_le_bytes().iter()).chain(payload.as_bytes()) {
            hash ^= *b as u64;
            hash = hash.wrapping_mul(0x100000001b3);
        }
        hash
    }
}

pub struct GateOmega;

impl GateOmega {
    /// Verdict is not dynamics: evaluates immutable candidate x̃_{t+1} and returns d_{t+1}.
    pub fn evaluate_verdict(candidate: &Record, witness_ready: bool) -> GateVerdict {
        if !candidate.structure_valid {
            GateVerdict { decision: GateStatus::Kill, reason: FailureCode::StructureInvalid }
        } else if !witness_ready {
            GateVerdict { decision: GateStatus::Kill, reason: FailureCode::HashChainBroken }
        } else if !candidate.admissibility_flag {
            GateVerdict { decision: GateStatus::Kill, reason: FailureCode::Inadmissible }
        } else if !candidate.iks_reversible {
            GateVerdict { decision: GateStatus::Kill, reason: FailureCode::IksReversibilityFailed }
        } else if !candidate.rosetta_identity_ok {
            GateVerdict { decision: GateStatus::Kill, reason: FailureCode::RosettaIdentityDrift }
        } else if candidate.audit_required && !candidate.audit_pass {
            GateVerdict { decision: GateStatus::Kill, reason: FailureCode::AuditFailed }
        } else if !candidate.reproducible {
            GateVerdict { decision: GateStatus::Kill, reason: FailureCode::NonReproducible }
        } else if candidate.pre_commit_g >= 0.0 {
            GateVerdict { decision: GateStatus::Kill, reason: FailureCode::PostCausalBoundaryCrossed }
        } else if candidate.uncertainty_high || candidate.etor_risk_pi >= candidate.etor_threshold_tau {
            GateVerdict { decision: GateStatus::Hold, reason: FailureCode::HighUncertainty }
        } else {
            GateVerdict { decision: GateStatus::Open, reason: FailureCode::None }
        }
    }
}

pub struct WitnessLog {
    pub events: Vec<WitnessEvent>,
    pub head_hash: u64,
}

impl WitnessLog {
    pub fn new() -> Self {
        Self { events: Vec::new(), head_hash: 0 }
    }

    pub fn verify_chain(&self) -> bool {
        let mut expected_prev = 0u64;
        for ev in &self.events {
            if ev.prev_hash != expected_prev {
                return false;
            }
            expected_prev = ev.event_hash;
        }
        expected_prev == self.head_hash
    }

    pub fn append(
        &mut self,
        object_id: u64,
        operation: &'static str,
        result: GateStatus,
        reason_code: FailureCode,
        timestamp: u64,
        tau_coord: u64,
    ) -> u64 {
        let event_id = (self.events.len() + 1) as u64;
        let prev_hash = self.head_hash;
        let event_hash = ProjectorPi::compute_hash(prev_hash, event_id, operation);
        self.events.push(WitnessEvent {
            event_id,
            object_id,
            prev_hash,
            event_hash,
            operation,
            result,
            reason_code,
            timestamp,
            tau_coord,
        });
        self.head_hash = event_hash;
        event_hash
    }
}

pub struct KyEngine<R: WorldRules> {
    pub rules: R,
    pub world_state: HashMap<u64, Record>,
    pub blueprints: HashMap<u64, Record>, // HOLD workshop (Γ_η)
    pub witness_log: WitnessLog,
    pub or_fuse_state: u64,
    pub tick: u64, // Passive attempt counter (t)
    pub tau: u64,  // Causal time coordinate (τ) — advances ONLY on OPEN/COMMIT
}

impl<R: WorldRules> KyEngine<R> {
    pub fn new(rules: R) -> Self {
        Self {
            rules,
            world_state: HashMap::new(),
            blueprints: HashMap::new(),
            witness_log: WitnessLog::new(),
            or_fuse_state: 0,
            tick: 0,
            tau: 0,
        }
    }

    pub fn step(&mut self, object_id: u64, raw_input: &str) -> GateStatus {
        self.tick += 1;

        let parsed = match Parser::parse(object_id, raw_input) {
            Ok(p) => p,
            Err(code) => {
                self.witness_log.append(object_id, "PARSE", GateStatus::Kill, code, self.tick, self.tau);
                return GateStatus::Kill;
            }
        };

        let candidate_phi = match GeneratorPhi::generate(parsed, self.tau) {
            Ok(c) => c,
            Err(code) => {
                self.witness_log.append(object_id, "PHI_GEN", GateStatus::Kill, code, self.tick, self.tau);
                return GateStatus::Kill;
            }
        };

        let mut x_tilde = match ProjectorPi::project(candidate_phi, &self.rules, self.witness_log.head_hash) {
            Ok(s) => s,
            Err(code) => {
                self.witness_log.append(object_id, "PI_PROJ", GateStatus::Kill, code, self.tick, self.tau);
                return GateStatus::Kill;
            }
        };

        let witness_ready = self.witness_log.verify_chain();
        let verdict = GateOmega::evaluate_verdict(&x_tilde, witness_ready);
        x_tilde.gate_status = verdict.decision;
        x_tilde.failure_code = verdict.reason;

        match verdict.decision {
            GateStatus::Open => {
                match Typechecker::verify_transition(x_tilde.lifecycle_state, LifecycleState::Committed) {
                    Ok(committed_state) => {
                        self.tau += 1; // Only an authorized COMMIT advances causal time τ!
                        self.or_fuse_state = PhaseCommitLogic::or_fuse_commit(self.or_fuse_state, x_tilde.integrity_hash);
                        x_tilde.lifecycle_state = committed_state;
                        x_tilde.or_fuse_latch = self.or_fuse_state;
                        x_tilde.tau_coord = self.tau;
                        self.blueprints.remove(&object_id);
                        self.world_state.insert(object_id, x_tilde);
                        self.witness_log.append(object_id, "COMMIT", GateStatus::Open, FailureCode::None, self.tick, self.tau);
                        GateStatus::Open
                    }
                    Err(code) => {
                        self.witness_log.append(object_id, "TYPECHECK", GateStatus::Kill, code, self.tick, self.tau);
                        GateStatus::Kill
                    }
                }
            }
            GateStatus::Hold => {
                self.blueprints.insert(object_id, x_tilde);
                self.witness_log.append(object_id, "FREEZE_HOLD", GateStatus::Hold, verdict.reason, self.tick, self.tau);
                GateStatus::Hold
            }
            GateStatus::Kill => {
                self.blueprints.remove(&object_id);
                self.witness_log.append(object_id, "TERMINATE_KILL", GateStatus::Kill, verdict.reason, self.tick, self.tau);
                GateStatus::Kill
            }
        }
    }
}

Committed objects in world: 1
Active blueprints (HOLD):   0
Witness log entries:        3
Wall-clock ticks (t):       3
Causal coordinate (τ):      1
Hash chain valid:           true
STATUS: NOMINAL. Equilibrium verified at (S1=1, S2=1)