//! Conformance: the reference scenario must seal a receipt whose every
//! load-bearing field is fixed, whose energy figure is honest, and whose JCR-1
//! envelope verifies. A second run must produce byte-identical bytes.

use mesh_conformance::{reference_scenario, MAX_TOKENS, SPAN_UJ};
use mesh_schema::{BackendId, Fidelity, Provenance};

#[test]
fn reference_receipt_fields_are_pinned() {
    let s = reference_scenario();
    let r = &s.receipt;

    // Cheapest-sufficient route: F1 floor rules out the F0 cache; tiny wins.
    assert_eq!(r.backend, BackendId::new("tiny"));
    assert_eq!(r.recipe, "ssm-1b");
    assert!(r.fidelity_met);
    assert_eq!(r.fidelity_floor, Fidelity::F1);

    // Honest measured energy from the HwShunt meter.
    assert_eq!(r.energy.provenance, Provenance::HwShunt);
    assert_eq!(r.energy.measured_uj, Some(SPAN_UJ));

    // The wedge metric: SPAN_UJ over MAX_TOKENS accepted tokens.
    assert_eq!(r.outcome.tokens_accepted, MAX_TOKENS);
    assert_eq!(r.uj_per_accepted_token(), Some(SPAN_UJ / MAX_TOKENS as u64));
    assert_eq!(r.uj_per_accepted_token(), Some(50_000));

    // Genesis receipt of the steward's chain.
    assert_eq!(r.sequence, 0);
    assert!(r.prev.is_none());
}

#[test]
fn reference_envelope_verifies_and_route_is_auditable() {
    let s = reference_scenario();

    // The sealed envelope verifies under the steward key.
    assert!(s
        .receipt
        .verify_envelope(&s.envelope, &s.steward, &s.verifying_key)
        .is_ok());

    // A tampered byte breaks verification.
    let mut bad = s.envelope.clone();
    let last = bad.len() - 1;
    bad[last] ^= 0x01;
    assert!(s
        .receipt
        .verify_envelope(&bad, &s.steward, &s.verifying_key)
        .is_err());

    // Every backend the router weighed is recorded, with admissibility + reason.
    assert_eq!(s.route.candidates.len(), 4);
    let cache = s
        .route
        .candidates
        .iter()
        .find(|c| c.backend == BackendId::new("cache"))
        .unwrap();
    assert!(!cache.admissible); // below the F1 floor
    assert!(cache.reason.as_ref().unwrap().contains("floor"));
    let merge = s
        .route
        .candidates
        .iter()
        .find(|c| c.backend == BackendId::new("merge"))
        .unwrap();
    assert!(!merge.admissible); // over the joule ceiling
    assert!(merge.reason.as_ref().unwrap().contains("ceiling"));
}

#[test]
fn reference_scenario_is_deterministic() {
    let a = reference_scenario();
    let b = reference_scenario();
    // Same inputs → byte-identical sealed receipts.
    assert_eq!(a.envelope, b.envelope);
    assert_eq!(a.receipt, b.receipt);
}

#[test]
fn wire_core_has_no_bools_or_nulls() {
    // The signed core must encode (det-CBOR forbids bool/null); fidelity_met is
    // a 0|1 uint in the wire form.
    let s = reference_scenario();
    let wire = s.receipt.to_jcr1_wire(&s.steward);
    let obj = wire.as_object().unwrap();
    assert_eq!(obj.get("mesh_receipt").unwrap(), "mesh/1");
    assert_eq!(obj.get("fidelity_met").unwrap(), 1);
    assert_eq!(obj.get("uj_per_accepted_token").unwrap(), 50_000);
    // signing the core succeeds (no disallowed types).
    assert!(s.receipt.signed_core(&s.steward).is_ok());
}