社會技術交付鏈與主權授權閘門：輸出後果化、爆炸半徑約束與停止時間不變式

// 社會技術交付邊界：主權授權閘門與爆炸半徑熔斷器實作 (Rust 2021)
// 零外部依賴，純標準庫，自包含驗證邏輯

use std::sync::atomic::{AtomicBool, AtomicU64, Ordering};

#[derive(Debug, Clone, PartialEq)]
pub struct ActionProposal {
    pub action_id: u64,
    pub financial_impact: u64, // 單位：美元
    pub payload: String,
}

// 型別狀態：未授權建議
#[derive(Debug)]
pub struct Proposed;
// 型別狀態：經主權閘門驗證合格
#[derive(Debug)]
pub struct Authorized;

// 強型別行動封裝，只有具備 Authorized 標記才能被執行單元消費
#[derive(Debug)]
pub struct ActionEnvelope<State> {
    proposal: ActionProposal,
    _marker: std::marker::PhantomData<State>,
}

impl ActionEnvelope<Proposed> {
    pub fn new(proposal: ActionProposal) -> Self {
        Self {
            proposal,
            _marker: std::marker::PhantomData,
        }
    }
}

// 主權授權閘門
pub struct SovereignGate {
    max_single_impact: u64,
    max_accumulated_impact: u64,
    current_accumulated: AtomicU64,
    error_count: AtomicU64,
    max_errors_before_trip: u64,
    is_tripped: AtomicBool,
}

impl SovereignGate {
    pub fn new(max_single: u64, max_accumulated: u64, max_errors: u64) -> Self {
        Self {
            max_single_impact: max_single,
            max_accumulated_impact: max_accumulated,
            current_accumulated: AtomicU64::new(0),
            error_count: AtomicU64::new(0),
            max_errors_before_trip: max_errors,
            is_tripped: AtomicBool::new(false),
        }
    }

    // 核心審查函數：將 Proposed 躍遷為 Authorized，若違規直接拒絕
    pub fn authorize(
        &self,
        envelope: ActionEnvelope<Proposed>,
    ) -> Result<ActionEnvelope<Authorized>, &'static str> {
        // 1. 檢查硬體級熔斷停止時間
        if self.is_tripped.load(Ordering::SeqCst) {
            return Err("GATE_TRIPPED_EMERGENCY_HALT");
        }

        let impact = envelope.proposal.financial_impact;

        // 2. 單筆爆炸半徑檢查
        if impact > self.max_single_impact {
            self.record_error();
            return Err("BLAST_RADIUS_SINGLE_EXCEEDED");
        }

        // 3. 累積爆炸半徑原子更新與檢查
        let mut current = self.current_accumulated.load(Ordering::SeqCst);
        loop {
            if current + impact > self.max_accumulated_impact {
                self.record_error();
                return Err("BLAST_RADIUS_ACCUMULATED_EXCEEDED");
            }
            match self.current_accumulated.compare_exchange_weak(
                current,
                current + impact,
                Ordering::SeqCst,
                Ordering::SeqCst,
            ) {
                Ok(_) => break,
                Err(actual) => current = actual,
            }
        }

        // 通過所有不變式檢查，型別狀態提升
        Ok(ActionEnvelope {
            proposal: envelope.proposal,
            _marker: std::marker::PhantomData,
        })
    }

    fn record_error(&self) {
        let errs = self.error_count.fetch_add(1, Ordering::SeqCst) + 1;
        if errs >= self.max_errors_before_trip {
            self.is_tripped.store(true, Ordering::SeqCst);
        }
    }

    pub fn is_halted(&self) -> bool {
        self.is_tripped.load(Ordering::SeqCst)
    }
}

// 實體執行單元：編譯期保證只接受 Authorized 狀態的信封
pub struct ExecutionEngine;

impl ExecutionEngine {
    pub fn execute(envelope: ActionEnvelope<Authorized>) -> u64 {
        // 實體下單或不可逆寫入
        envelope.proposal.financial_impact
    }
}

fn main() {
    // 初始化授權閘門：單筆上限 10,000，全域上限 25,000，容忍 2 次違規即熔斷
    let gate = SovereignGate::new(10_000, 25_000, 2);

    // 1. 合法正常操作
    let p1 = ActionProposal { action_id: 1, financial_impact: 8_000, payload: "BUY AAPL".into() };
    let env1 = ActionEnvelope::new(p1);
    let auth1 = gate.authorize(env1).expect("應該授權通過");
    assert_eq!(ExecutionEngine::execute(auth1), 8_000);

    // 2. 違規操作 A：單筆爆炸半徑超標 (15,000 > 10,000)
    let p2 = ActionProposal { action_id: 2, financial_impact: 15_000, payload: "BUY TSLA".into() };
    let env2 = ActionEnvelope::new(p2);
    assert_eq!(gate.authorize(env2).unwrap_err(), "BLAST_RADIUS_SINGLE_EXCEEDED");

    // 3. 合法操作續行：累積至 8,000 + 9,000 = 17,000 <= 25,000
    let p3 = ActionProposal { action_id: 3, financial_impact: 9_000, payload: "BUY MSFT".into() };
    let env3 = ActionEnvelope::new(p3);
    let auth3 = gate.authorize(env3).expect("應該授權通過");
    assert_eq!(ExecutionEngine::execute(auth3), 9_000);

    // 4. 違規操作 B：累積爆炸半徑耗竭 (17,000 + 9,000 = 26,000 > 25,000)
    // 此時觸發第 2 次錯誤，達到 max_errors_before_trip，觸發停止時間熔斷！
    let p4 = ActionProposal { action_id: 4, financial_impact: 9_000, payload: "BUY GOOGL".into() };
    let env4 = ActionEnvelope::new(p4);
    assert_eq!(gate.authorize(env4).unwrap_err(), "BLAST_RADIUS_ACCUMULATED_EXCEEDED");
    assert!(gate.is_halted(), "系統必須進入安全熔斷終止狀態");

    // 5. 熔斷後的任何後續請求，即使微小亦被強制拒絕
    let p5 = ActionProposal { action_id: 5, financial_impact: 100, payload: "BUY AMZN".into() };
    let env5 = ActionEnvelope::new(p5);
    assert_eq!(gate.authorize(env5).unwrap_err(), "GATE_TRIPPED_EMERGENCY_HALT");

    println!("Rust 自驗證通過：主權授權閘門成功在編譯期與執行期維護爆炸半徑不變式。");
}