name: wai-quantum verdicts and repairs

# The verified-answer contract (wai/wai-quantum/src/engine/verdict.rs,
# repair.rs and refusal.rs): a verdict's level for every answer, each intent
# checked against ground truth, a repair held to the flagged lines, the job
# layer's refusal codes and the page that documents them, and the byte
# identity of every job that asks for no verdict. Then the intent
# conformance set (wai/quantum-conformance/intents/: programs, their intents
# and the verdict each must get), natively, where a second test holds its
# bundle equal to its files, and under wasm32-wasip2 by wasmtime, where the
# cases come from the bundle the test compiles in. The browser build runs the
# set too (wai-web-wasm.yml, wai-web's wasm32 tests).
#
# The verdict conformance set (wai/quantum-conformance/verdicts/: sealed jobs
# and what a verifier must say of each one's verdict, quantum-providers §8.9)
# runs here too, natively (where every job is also made again by this engine)
# and under wasm32-wasip2: a verdict that holds, one that fails, one no layer
# decided, one past what a verifier works out again, and ones a host sealed
# that its job does not bear out, which are refused. Its provider, qudit and
# sign-off jobs are made from receipts in wai/quantum-conformance/receipts/.
# Its grades (quantum-providers §8.10, engine::grade: a program held to a
# task's cases, sealed as a job) pass, fail, are partly past what a verifier
# works out again, and are forged; each is made again by this engine. The
# sign-off loop every surface serves (engine::front: check, grade, attest) is
# tested beside them, and the grades conformance set
# (wai/quantum-conformance/grades/: whole task sets graded, quantum-providers
# §8.10, and what a reader must say of each batch) runs natively, where every
# batch is made again, and under wasm32-wasip2.
#
# The answer view layer (engine/answer/: view statements over OpenQASM 3, each
# bound to an engine call) and correctness telemetry (engine/telemetry.rs) run
# here too: the layer's tests (the stream ending as the whole text reads at
# every split, every code), and its conformance set
# (wai/quantum-conformance/answers/: each answer's codes, root and order, its
# views run to what they must show, the stored answers' receipts verified by
# running them again), natively and under wasm32-wasip2.

concurrency:
  group: ${{ github.workflow }}-${{ github.event_name == 'push' && github.sha || github.ref }}
  cancel-in-progress: true

on:
  push:
    branches: [main]
    paths:
      - 'wai/wai-quantum/**'
      - 'wai/quantum-conformance/intents/**'
      - 'wai/quantum-conformance/answers/**'
      - 'wai/quantum-conformance/verdicts/**'
      - 'wai/quantum-conformance/grades/**'
      - 'wai/quantum-conformance/receipts/jobs/**'
      - 'rust-toolchain.toml'
      - '.github/workflows/wai-quantum-verdict.yml'
  pull_request:
    paths:
      - 'wai/wai-quantum/**'
      - 'wai/quantum-conformance/intents/**'
      - 'wai/quantum-conformance/answers/**'
      - 'wai/quantum-conformance/verdicts/**'
      - 'wai/quantum-conformance/grades/**'
      - 'wai/quantum-conformance/receipts/jobs/**'
      - 'rust-toolchain.toml'
      - '.github/workflows/wai-quantum-verdict.yml'

jobs:
  relevant:
    name: does this change touch it
    runs-on: gate
    outputs:
      run: ${{ steps.gate.outputs.run }}
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0
      - id: gate
        run: |
          set -euo pipefail
          r=$(python3 scripts/pr-touches-paths.py .github/workflows/wai-quantum-verdict.yml \
                "${{ github.event.pull_request.base.sha }}" \
                "${{ github.event.pull_request.head.sha }}")
          echo "this change touches the verdicts: $r"
          echo "run=$r" >> "$GITHUB_OUTPUT"

  native:
    name: verdicts, repairs and the intent set · linux
    needs: relevant
    if: needs.relevant.outputs.run == 'true'
    runs-on: linux
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v5
      - name: Install Rust 1.99.1
        shell: bash
        run: |
          export PATH="$HOME/.cargo/bin:$PATH"
          command -v rustup >/dev/null 2>&1 || \
            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain 1.99.1
          rustup toolchain install 1.99.1 --profile minimal
          rustup default 1.99.1
          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
      # A module filter is satisfied by any one test of the module, so each
      # module's tests are required by name to have run.
      - name: The verdict, the sign-off loop, the repair and the codes
        shell: bash
        working-directory: wai/wai-quantum
        run: |
          set -euo pipefail
          cargo test --locked --release --features full --lib -- engine::verdict:: engine::signoff:: engine::grade:: engine::front:: engine::guide:: engine::repair:: engine::refusal:: engine::job:: 2>&1 | tee "$RUNNER_TEMP/verdict.log"
          grep -qE '^test result: ok\. [1-9][0-9]* passed; 0 failed' "$RUNNER_TEMP/verdict.log" || { echo "::error::the verdict's tests did not pass"; exit 1; }
          for t in engine::verdict::tests::each_intent_is_decided_as_ground_truth_says \
                   engine::verdict::tests::the_level_is_the_weakest_check_and_holds_says_the_outcome \
                   engine::verdict::tests::an_expectation_a_set_of_outcomes_a_conserved_quantity_and_the_counts_are_each_decided \
                   engine::verdict::tests::a_verdict_names_the_layer_that_decided_it_and_its_limits \
                   engine::verdict::tests::a_job_of_counts_and_a_landscape_job_are_each_read_as_a_verdict \
                   engine::verdict::tests::a_sealed_verdict_is_worked_out_again_and_a_false_one_refused \
                   engine::signoff::tests::a_sign_off_seals_a_sealed_jobs_intent_and_verdict_and_is_worked_out_again \
                   engine::signoff::tests::a_sign_off_is_only_of_a_job_whose_receipt_verifies \
                   engine::signoff::tests::a_sign_off_is_never_of_a_verdict_its_job_does_not_bear_out \
                   engine::grade::tests::a_grade_gives_each_case_its_grade_and_layer_and_is_worked_out_again \
                   engine::grade::tests::a_failing_case_and_a_broken_constraint_fail_the_grade_each_with_why \
                   engine::grade::tests::a_grade_of_a_generator_runs_each_case_at_its_inputs \
                   engine::grade::tests::a_grade_is_refused_where_its_task_does_not_read_or_would_publish_its_answer \
                   engine::grade::tests::a_grade_its_job_does_not_bear_out_is_refused_though_its_seal_holds \
                   engine::grade::tests::a_task_set_graded_whole_is_one_sealed_grade_a_task_and_a_summary_worked_out_again \
                   engine::front::tests::the_loop_s_three_calls_answer_as_every_surface_answers \
                   engine::front::tests::the_tools_are_check_grade_and_attest_in_that_order \
                   engine::guide::tests::resources_list_and_read_and_prompts_name_the_host_s_tools \
                   engine::repair::tests::each_rule_makes_the_fix_a_person_would_on_the_flagged_line \
                   engine::repair::tests::a_proposal_may_change_only_the_flagged_lines \
                   engine::refusal::tests::the_documented_table_is_the_table \
                   engine::job::tests::a_job_that_asks_for_no_verdict_gives_the_bytes_it_gave \
                   engine::job::tests::every_refusal_an_agent_can_act_on_carries_its_code; do
            grep -q "^test $t \.\.\. ok$" "$RUNNER_TEMP/verdict.log" || { echo "::error::$t did not run"; exit 1; }
          done
      - name: The intent conformance set
        shell: bash
        working-directory: wai/wai-quantum
        run: |
          set -euo pipefail
          cargo test --locked --release --features full --test intent_conformance 2>&1 | tee "$RUNNER_TEMP/intents.log"
          grep -q 'test result: ok. 2 passed; 0 failed' "$RUNNER_TEMP/intents.log" || { echo "::error::the intent set did not pass"; exit 1; }
      - name: The verdict conformance set
        shell: bash
        working-directory: wai/wai-quantum
        run: |
          set -euo pipefail
          cargo test --locked --release --features full --test verdict_conformance 2>&1 | tee "$RUNNER_TEMP/verdicts.log"
          grep -q 'test result: ok. 2 passed; 0 failed' "$RUNNER_TEMP/verdicts.log" || { echo "::error::the verdict set did not pass"; exit 1; }
          for t in every_sealed_verdict_gets_the_answer_its_manifest_gives the_corpus_is_what_this_engine_seals; do
            grep -q "^test $t \.\.\. ok$" "$RUNNER_TEMP/verdicts.log" || { echo "::error::$t did not run"; exit 1; }
          done
      - name: The grades conformance set
        shell: bash
        working-directory: wai/wai-quantum
        run: |
          set -euo pipefail
          cargo test --locked --release --features full --test grades_conformance 2>&1 | tee "$RUNNER_TEMP/grades.log"
          grep -q 'test result: ok. 2 passed; 0 failed' "$RUNNER_TEMP/grades.log" || { echo "::error::the grades set did not pass"; exit 1; }
          for t in every_batch_gets_the_answer_its_manifest_gives the_set_is_what_this_engine_makes; do
            grep -q "^test $t \.\.\. ok$" "$RUNNER_TEMP/grades.log" || { echo "::error::$t did not run"; exit 1; }
          done
      - name: The answer view layer, telemetry, and the answer conformance set
        shell: bash
        working-directory: wai/wai-quantum
        run: |
          set -euo pipefail
          cargo test --locked --release --features full --lib -- engine::answer:: engine::telemetry:: 2>&1 | tee "$RUNNER_TEMP/answer.log"
          for t in engine::answer::tests::streaming_at_every_split_ends_as_the_whole_text_reads \
                   engine::answer::tests::every_problem_has_its_code_and_says_what_becomes_of_the_statement \
                   engine::answer::tests::an_answer_s_calls_run_on_the_engine_and_its_seal_verifies_when_run_again \
                   engine::answer::tests::a_chain_of_statements_past_the_limit_is_refused_not_overflowed \
                   engine::answer::tests::the_chain_limit_refuses_the_same_statements_in_any_order \
                   engine::telemetry::tests::the_failures_become_a_corpus_in_the_conformance_format; do
            grep -q "^test $t \.\.\. ok$" "$RUNNER_TEMP/answer.log" || { echo "::error::$t did not run"; exit 1; }
          done
          cargo test --locked --release --features full --test answer_conformance 2>&1 | tee "$RUNNER_TEMP/answers.log"
          grep -q 'test result: ok. 2 passed; 0 failed' "$RUNNER_TEMP/answers.log" || { echo "::error::the answer set did not pass"; exit 1; }

  wasip2:
    name: the intent set and the verdict under wasm32-wasip2 (wasmtime)
    needs: relevant
    if: needs.relevant.outputs.run == 'true'
    runs-on: linux
    timeout-minutes: 60
    steps:
      - uses: actions/checkout@v5
      - name: Install Rust 1.99.1 with the wasm32-wasip2 target
        shell: bash
        run: |
          export PATH="$HOME/.cargo/bin:$PATH"
          command -v rustup >/dev/null 2>&1 || \
            curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --profile minimal --default-toolchain 1.99.1
          rustup toolchain install 1.99.1 --profile minimal
          rustup default 1.99.1
          rustup target add --toolchain 1.99.1 wasm32-wasip2
          echo "$HOME/.cargo/bin" >> "$GITHUB_PATH"
      # The release binary, pinned by version and SHA-256, rather than a build from source.
      # Every WAI workflow that runs wasmtime pins this one version, and every run passes
      # -W nan-canonicalization=y -W relaxed-simd-deterministic=y: every NaN a float
      # instruction makes is the canonical one, and each relaxed SIMD instruction has one
      # behaviour on every host. A stock wasmtime leaves both off. The fixed relaxed
      # behaviour is the engine's own: on 50.0.1 relaxed_madd is fused (measured on arm64 and
      # x86_64), where WebAssembly's deterministic profile prescribes the unfused result.
      # The repository checks (scripts/check-wasmtime-pin.py) fail a workflow that pins another
      # release or runs wasmtime without both settings.
      - name: Install wasmtime 50.0.1
        shell: bash
        run: |
          set -euo pipefail
          [ "$(uname -m)" = x86_64 ] || { echo "::error::the pinned wasmtime archive is x86_64; this host is $(uname -m)"; exit 1; }
          if ! command -v xz >/dev/null 2>&1; then
            SUDO=""; [ "$(id -u)" -ne 0 ] && SUDO="sudo"
            $SUDO apt-get update -qq
            $SUDO apt-get install -y -qq xz-utils
          fi
          v=50.0.1
          f="wasmtime-v$v-x86_64-linux.tar.xz"
          curl --proto '=https' --tlsv1.2 -sSfL -o "$RUNNER_TEMP/$f" \
            "https://github.com/bytecodealliance/wasmtime/releases/download/v$v/$f"
          echo "685466455dd42a14774a86c36c8f2e45cbb9bd6d92a850139315df60a75498a5  $RUNNER_TEMP/$f" | sha256sum -c -
          tar -xJf "$RUNNER_TEMP/$f" -C "$RUNNER_TEMP"
          echo "$RUNNER_TEMP/wasmtime-v$v-x86_64-linux" >> "$GITHUB_PATH"
      # A debug build, so integer overflow panics instead of wrapping. The test
      # that reads the set's files has no wasip2 build; the one that runs the
      # cases from the compiled-in bundle does.
      - name: The intent set under wasmtime
        shell: bash
        working-directory: wai/wai-quantum
        env:
          CARGO_TARGET_WASM32_WASIP2_RUNNER: wasmtime run -W nan-canonicalization=y -W relaxed-simd-deterministic=y
        run: |
          set -euo pipefail
          cargo test --locked --target wasm32-wasip2 --features full --test intent_conformance 2>&1 | tee "$RUNNER_TEMP/wasip2.log"
          grep -q 'test result: ok. 1 passed; 0 failed' "$RUNNER_TEMP/wasip2.log" || { echo "::error::the intent set did not pass under wasip2"; exit 1; }
          cargo test --locked --target wasm32-wasip2 --features full --test answer_conformance 2>&1 | tee "$RUNNER_TEMP/wasip2-answers.log"
          grep -q 'test result: ok. 1 passed; 0 failed' "$RUNNER_TEMP/wasip2-answers.log" || { echo "::error::the answer set did not pass under wasip2"; exit 1; }
          cargo test --locked --target wasm32-wasip2 --features full --test verdict_conformance 2>&1 | tee "$RUNNER_TEMP/wasip2-verdicts.log"
          grep -q 'test result: ok. 1 passed; 0 failed' "$RUNNER_TEMP/wasip2-verdicts.log" || { echo "::error::the verdict set did not pass under wasip2"; exit 1; }
          cargo test --locked --target wasm32-wasip2 --features full --test grades_conformance 2>&1 | tee "$RUNNER_TEMP/wasip2-grades.log"
          grep -q 'test result: ok. 1 passed; 0 failed' "$RUNNER_TEMP/wasip2-grades.log" || { echo "::error::the grades set did not pass under wasip2"; exit 1; }
      - name: The verdict and the repair under wasmtime
        shell: bash
        working-directory: wai/wai-quantum
        env:
          CARGO_TARGET_WASM32_WASIP2_RUNNER: wasmtime run -W nan-canonicalization=y -W relaxed-simd-deterministic=y
        run: |
          set -euo pipefail
          cargo test --locked --target wasm32-wasip2 --features full --lib -- engine::verdict:: engine::repair:: engine::refusal:: 2>&1 | tee "$RUNNER_TEMP/wasip2-lib.log"
          for m in engine::verdict engine::repair engine::refusal; do
            grep -q "^test $m::.* \.\.\. ok$" "$RUNNER_TEMP/wasip2-lib.log" || { echo "::error::no test of $m ran"; exit 1; }
          done