open-standards/wai/wai-web/src/quantum_ops.rs

//! Quantum-operations ATTESTATION in the browser (`wai.quantum.calibration` /
//! `wai.quantum.job`). The SAME `wai::quantum_ops` receipts native tools produce,
//! compiled to wasm32 — so the page can seal a signed, joule-metered, grant-
//! authorized receipt, then demonstrate gate ⊗ meter ⊗ receipt live:
//! tamper a field → `verify()` fails; blow the joule budget → `verify()` fails;
//! bind a job to (or mismatch it against) a calibration state. No hardware; WAI
//! owns the receipt.

use ed25519_dalek::SigningKey;
use wai::quantum_energy::MaybeLabelled;
use wai::quantum_ops::{content_hash, CalibrationReceipt, Evidence, GrantRef, JobReceipt};
use wasm_bindgen::prelude::*;

fn hex(b: &[u8]) -> String {
    b.iter().map(|x| format!("{x:02x}")).collect()
}

fn from_hex32(s: &str) -> Option<[u8; 32]> {
    if s.len() != 64 || !s.bytes().all(|b| b.is_ascii_hexdigit()) {
        return None;
    }
    let mut out = [0u8; 32];
    for (i, c) in s.as_bytes().chunks(2).enumerate() {
        out[i] = u8::from_str_radix(std::str::from_utf8(c).ok()?, 16).ok()?;
    }
    Some(out)
}

/// A deterministic demo signing key (the sink would use its own identity key).
fn key(seed: u8) -> SigningKey {
    SigningKey::from_bytes(&[seed; 32])
}

fn grant(capability: &str, joule_ceiling: u64) -> GrantRef {
    GrantRef {
        grant_hash: content_hash(capability.as_bytes()),
        capability: capability.to_string(),
        joule_ceiling_micro: joule_ceiling,
        funds_ceiling: None,
    }
}

#[wasm_bindgen]
pub struct QuantumCal {
    inner: CalibrationReceipt,
}

#[wasm_bindgen]
impl QuantumCal {
    /// Seal a calibration receipt. `config_bytes` and `evidence_bytes` are the raw
    /// artifacts (content-addressed inside); `joule_ceiling` is the grant's budget.
    #[allow(clippy::too_many_arguments)]
    #[wasm_bindgen(constructor)]
    pub fn new(
        seed: u8,
        device: &str,
        target: &str,
        config_bytes: &[u8],
        evidence_kind: &str,
        evidence_bytes: &[u8],
        evidence_summary: &str,
        joules_micro: u64,
        capability: &str,
        joule_ceiling: u64,
    ) -> QuantumCal {
        let ev = vec![Evidence {
            kind: evidence_kind.to_string(),
            blob_hash: content_hash(evidence_bytes),
            summary: evidence_summary.to_string(),
        }];
        let inner = CalibrationReceipt::seal(
            &key(seed),
            "did:key:demo-lab",
            device,
            target,
            content_hash(config_bytes),
            ev,
            joules_micro,
            grant(capability, joule_ceiling),
            None,
        );
        QuantumCal { inner }
    }

    pub fn json(&self) -> String {
        self.inner.to_json()
    }
    /// Cryptographically valid AND within the grant's joule budget.
    pub fn verify(&self) -> bool {
        self.inner.verify()
    }
    pub fn honors_budget(&self) -> bool {
        self.inner.honors_budget()
    }
    pub fn joules_micro(&self) -> u64 {
        self.inner.joules_micro
    }
    pub fn joule_ceiling(&self) -> u64 {
        self.inner.grant.joule_ceiling_micro
    }
    pub fn receipt_hash_hex(&self) -> String {
        hex(&self.inner.receipt_hash())
    }
    /// Tamper: overwrite the signed `joules_micro`. `verify()` now fails — the
    /// signature no longer covers the mutated field.
    pub fn tamper_joules(&mut self, j: u64) {
        self.inner.joules_micro = j;
    }
    /// A fidelity claim binds to the exact dataset bytes that produced it.
    pub fn evidence_matches(&self, bytes: &[u8]) -> bool {
        self.inner.evidence_matches(0, bytes)
    }
}

#[wasm_bindgen]
pub struct QuantumJob {
    inner: JobReceipt,
}

#[wasm_bindgen]
impl QuantumJob {
    /// Seal a job receipt. `cal_ref_hex` is the calibration receipt's hash (the
    /// device state it ran under); pass `null`/undefined for a simulator run.
    #[allow(clippy::too_many_arguments)]
    #[wasm_bindgen(constructor)]
    pub fn new(
        seed: u8,
        backend: &str,
        circuit_bytes: &[u8],
        result_bytes: &[u8],
        cal_ref_hex: Option<String>,
        shots: u64,
        joules_micro: u64,
        capability: &str,
        joule_ceiling: u64,
    ) -> Result<QuantumJob, JsError> {
        let cal_ref = match cal_ref_hex {
            Some(h) if !h.is_empty() => {
                Some(from_hex32(&h).ok_or_else(|| JsError::new("bad calibration_ref hex"))?)
            }
            _ => None,
        };
        let inner = JobReceipt::seal(
            &key(seed),
            "did:key:demo-lab",
            backend,
            content_hash(circuit_bytes),
            content_hash(result_bytes),
            cal_ref,
            shots,
            joules_micro,
            grant(capability, joule_ceiling),
            None,
        );
        Ok(QuantumJob { inner })
    }

    pub fn json(&self) -> String {
        self.inner.to_json()
    }
    pub fn verify(&self) -> bool {
        self.inner.verify()
    }
    pub fn receipt_hash_hex(&self) -> String {
        hex(&self.inner.receipt_hash())
    }
    /// The cross-link: does this job bind to the given calibration state? Confirms
    /// the job names that calibration's hash and both receipts verify. The
    /// calibration may be in either form — as sealed, or with its joule figure's
    /// acquisition class inside the signature — and is named by the identity of the
    /// form it is in.
    pub fn verify_against_calibration(&self, cal_json: &str) -> bool {
        match MaybeLabelled::<CalibrationReceipt>::from_json(cal_json) {
            Some(cal) => MaybeLabelled::Unlabelled(self.inner.clone()).verify_against_calibration(&cal),
            None => false,
        }
    }
}