BoundedAuthorityProtocol.Conformance.Cli (Bounded Authority Protocol v0.1.2)

Copy Markdown View Source

Deterministic offline verifier CLI for the v1 conformance corpus.

This is the package's I/O carve-out: argv parsing, File.read/File.ls to load a corpus directory, and report output (IO.binwrite/File.write). Every judgment — corpus integrity, case execution, agreement, report bytes — delegates to the PURE core (Corpus/Runner/Report). No clock, network, randomness, or trust selection here or in the pure core it calls.

Exit contract

  • 0 — complete agreement: every index file present, no unlisted file, every SHA-256 equal, every count equal, every required applicability cell nonempty, every n/a cell empty, every case verdict and producer output byte equal to expectation.
  • 1 — any disagreement, missing file, count mismatch, or integrity failure.
  • 2 — usage error (missing required --corpus, unknown flag, missing value).

--corpus DIR is REQUIRED (no default — a wrong-corpus run that exits 0 is a quiet misverification path in the tool built to eliminate quiet misverification).

Summary

Functions

run(argv)

Runs the CLI against argv and returns the contract exit status (0/1/2).

Functions

run(argv)

@spec run([binary()]) :: 0 | 1 | 2

Runs the CLI against argv and returns the contract exit status (0/1/2).

Does NOT halt — the escript entry Main.main/1 calls System.halt(Cli.run(argv)). The corpus directory is loaded via File.ls/File.read into the %{path => binary} map the pure Corpus.load/1 consumes (paths relative to the corpus dir, e.g. "cases/json/decode.json").

The certified index SHA-256 is bound from @certified_index_sha256 and is NOT caller-overridable — there is no seam by which a caller can supply its own expected value and pass a non-certified corpus. The pin's non-vacuity is proven without a seam (see cli_test: a corpus with insignificant index.json whitespace loads + agrees but has a different index SHA, and run/1 fails it closed).