wots_rhdl/verify/

tasks.rs

//! Exact, message-dependent verification work accounting.
//!
//! Verification emits only mask, real chain, and public-key endpoint-hash
//! tasks. A skipped chain position is a bypass and never appears in the task
//! set. The baseline deliberately derives mask zero to match the current
//! software oracle's sixteen-mask work contract, even though verification only
//! consumes masks one through fifteen.

use rhdl::prelude::*;

use crate::{
    digits::{CHAIN_COUNT, MessageBytes, MessageDigitArray, message_digits_kernel},
    tag::{DecodedTaskTag, TagFields, TaskKind, encode_tag_kernel, tag_is_well_formed_kernel},
};

/// Mask PRFs in the frozen current-oracle verifier contract.
pub const VERIFY_MASK_TASKS: usize = 16;
/// Serialized SHA-256 blocks in the 2,144-byte endpoint hash.
pub const VERIFY_PUBLIC_KEY_TASKS: usize = 34;
/// Minimum real chain hashes over every possible 32-byte message digest.
pub const VERIFY_MIN_CHAIN_TASKS: usize = 45;
/// Maximum real chain hashes over every possible 32-byte message digest.
pub const VERIFY_MAX_CHAIN_TASKS: usize = 990;
/// Minimum complete SHA verifier task count.
pub const VERIFY_MIN_SHA_TASKS: usize = 95;
/// Maximum complete SHA verifier task count.
pub const VERIFY_MAX_SHA_TASKS: usize = 1_040;

const _: () = {
    assert!(VERIFY_MIN_SHA_TASKS == VERIFY_MASK_TASKS + VERIFY_MIN_CHAIN_TASKS + 34);
    assert!(VERIFY_MAX_SHA_TASKS == VERIFY_MASK_TASKS + VERIFY_MAX_CHAIN_TASKS + 34);
};

/// Count real chain hashes from already-derived WOTS digits.
#[allow(clippy::assign_op_pattern, clippy::needless_range_loop)]
#[kernel]
pub fn verification_chain_count_kernel(digits: MessageDigitArray) -> b10 {
    let mut count = b10(0);
    for segment in 0..CHAIN_COUNT {
        let digit: b10 = digits[segment].resize();
        count = count + (b10(15) - digit);
    }
    count
}

/// Count exact SHA-256 compression tasks for one verifier operation.
#[kernel]
pub fn verification_sha_task_count_kernel(digits: MessageDigitArray) -> b11 {
    let chain: b11 = verification_chain_count_kernel(digits).resize();
    chain + b11((VERIFY_MASK_TASKS + VERIFY_PUBLIC_KEY_TASKS) as u128)
}

/// Derive digits and exact SHA task count from a 32-byte message digest.
#[kernel]
pub fn verification_message_task_count_kernel(message: MessageBytes) -> b11 {
    verification_sha_task_count_kernel(message_digits_kernel(message))
}

/// Return whether a tag is canonical and belongs to the verifier task subset.
#[kernel]
pub fn verification_tag_is_well_formed_kernel(tag: b32) -> bool {
    if tag_is_well_formed_kernel(tag) {
        let kind: b3 = (tag >> 4).resize();
        kind == b3(2) || kind == b3(6) || kind == b3(7)
    } else {
        false
    }
}

/// Build the one canonical chain tag named by a verifier segment stage.
///
/// Stages 3 through 17 name chain steps 1 through 15. Callers never invoke
/// this kernel for the endpoint sentinel stage 18.
#[kernel]
pub fn verification_chain_fields_kernel(
    stage: b5,
    segment: b7,
    context: b4,
    generation: b8,
) -> TagFields {
    TagFields {
        context,
        kind: b3(6),
        segment,
        chain_step: (stage - b5(2)).resize(),
        block_index: b6(0),
        generation,
    }
}

/// Encode and validate one verifier-owned task tag.
#[kernel]
pub fn verification_fields_are_canonical_kernel(fields: TagFields) -> bool {
    verification_tag_is_well_formed_kernel(encode_tag_kernel(fields))
}

/// Host-side exact chain count, rejecting digits outside base 16.
///
/// # Errors
///
/// Returns the first `(segment, digit)` whose digit exceeds fifteen.
pub fn verification_chain_count(digits: &[u8; CHAIN_COUNT]) -> Result<usize, (usize, u8)> {
    digits
        .iter()
        .copied()
        .enumerate()
        .try_fold(0_usize, |count, (segment, digit)| {
            if digit > 15 {
                Err((segment, digit))
            } else {
                Ok(count + usize::from(15 - digit))
            }
        })
}

/// Host-side exact SHA compression count for a valid message digit array.
///
/// # Errors
///
/// Returns the same invalid-digit diagnostic as [`verification_chain_count`].
pub fn verification_sha_task_count(digits: &[u8; CHAIN_COUNT]) -> Result<usize, (usize, u8)> {
    verification_chain_count(digits)
        .map(|chain| VERIFY_MASK_TASKS + chain + VERIFY_PUBLIC_KEY_TASKS)
}

/// Construct the unordered, unique set of all real verifier tasks.
///
/// The returned order is deterministic for audit readability: masks, real
/// chain transitions in segment/step order, then endpoint-hash blocks. A
/// parallel engine may issue them in any dependency-correct order.
///
/// # Panics
///
/// Panics if `context` does not fit the four-bit tag field.
#[must_use]
pub fn canonical_verification_tasks(
    context: u8,
    generation: u8,
    digits: &[u8; CHAIN_COUNT],
) -> Vec<DecodedTaskTag> {
    assert!(context < 16, "verification context must fit four bits");
    let expected = verification_sha_task_count(digits).expect("message digits are base 16");
    let mut tasks = Vec::with_capacity(expected);
    for mask in 0_u8..16 {
        tasks.push(
            DecodedTaskTag::new(context, TaskKind::Mask, mask, 0, 0, generation)
                .expect("mask tag is canonical"),
        );
    }
    for (segment, digit) in digits.iter().copied().enumerate() {
        for step in digit + 1..=15 {
            tasks.push(
                DecodedTaskTag::new(
                    context,
                    TaskKind::Chain,
                    u8::try_from(segment).expect("67 segments fit u8"),
                    step,
                    0,
                    generation,
                )
                .expect("chain tag is canonical"),
            );
        }
    }
    for block in 0_u8..34 {
        tasks.push(
            DecodedTaskTag::new(context, TaskKind::PublicKey, 0, 0, block, generation)
                .expect("public-key tag is canonical"),
        );
    }
    assert_eq!(tasks.len(), expected);
    tasks
}