corroborate

type Allowlist = allowlist.Allowlist

type Class string

type Consensus struct {
	// State is the cell state.
	State State

	// PassAllow is the count of allowlisted signers in S_pass.
	PassAllow int

	// FailAllow is the count of allowlisted signers in S_fail.
	FailAllow int

	// Reported is the count of non-allowlisted signers that actually ran the
	// row (passed or failed). Shown on the board, never counted toward state.
	Reported int
}

type Counts struct {
	Recipes int `json:"recipes"`
	CSPs    int `json:"csps"`
	Sources int `json:"sources"`
}

type Dashboard struct {
	Accelerator string `json:"accelerator"`
	OS          string `json:"os"`
	Tabs        []Tab  `json:"tabs"`
}

type GenerateResult struct {
	Recipes int
	Sources int
	Runs    int
}

type Group struct {
	Service    string      `json:"service"`
	Dashboards []Dashboard `json:"dashboards"`
}

type Index struct {
	// Schema is always SchemaVersion.
	Schema string `json:"schema"`

	// Meta is presentation metadata (outbound links, summary counts, and the
	// deterministic generated-at stamp). Additive; never feeds consensus.
	Meta Meta `json:"meta"`

	// Criteria holds the facet dropdown values per axis (service, accelerator,
	// os, intent, platform), ordered by the criteria registry's canonical
	// order and filtered to values actually present in the data.
	Criteria map[string][]string `json:"criteria"`

	// Sources maps each signer-id-hash to its display source record.
	Sources map[string]Source `json:"sources"`

	// Groups is the CSP-first catalog tree, ordered by service.
	Groups []Group `json:"groups"`
}

type Latest struct {
	// Src is the signer-id-hash (a key into Index.Sources).
	Src string `json:"src"`

	// Result is "pass" or "fail" (not-run signers are omitted from the grid).
	Result string `json:"result"`

	// AICRVer is the AICR version from the bundle predicate (a facet axis).
	AICRVer string `json:"aicrVer"`

	// K8sVer is the observed Kubernetes major.minor (a facet axis).
	K8sVer string `json:"k8sVer"`

	// When is the predicate AttestedAt rendered for display — never the
	// publish clock.
	When string `json:"when"`

	// Build is the run identifier.
	Build string `json:"build"`

	// EvidenceRef is the OCI ref of the signed bundle, for the drilldown link.
	EvidenceRef string `json:"evidenceRef"`
}

type Links struct {
	Install string `json:"install"`
	Docs    string `json:"docs"`
	GitHub  string `json:"github"`
}

type Meta struct {
	// Links are the outbound header navigation targets.
	Links Links `json:"links"`

	// Counts are the landing summary tallies.
	Counts Counts `json:"counts"`

	// GeneratedAt is the newest run AttestedAt rendered "YYYY-MM-DD HH:MM UTC",
	// or "" (omitted) when no run carried a parseable AttestedAt. Derived from
	// evidence, never the publish clock, so it stays byte-reproducible.
	GeneratedAt string `json:"generatedAt,omitempty"`
}

type Options struct {
	// InputDir is the root of the source-keyed GCS layout (Contract 3),
	// synced to a local directory. Generate finds every meta.json beneath it.
	InputDir string

	// OutputDir is where index.html and data/{index.json,series/*.json} are
	// written.
	OutputDir string

	// AllowlistPath, when set, re-derives each signer's class from its verified
	// (issuer, identity) against the allowlist instead of trusting meta.json's
	// pre-derived class. When empty, the class/allowlisted fields in meta.json
	// are trusted as-is — safe only because GP2 (the trusted ingest job, Contract
	// 3) writes them post-verification; point -allowlist at the in-tree allowlist
	// to re-verify when the input tree is not from a trusted ingest.
	AllowlistPath string
}

type Result string

type Row struct {
	Phase     string   `json:"phase"`
	Name      string   `json:"name"`
	Consensus string   `json:"consensus"`
	Reported  int      `json:"reported"`
	Signers   []Latest `json:"signers"`
}

type RunMeta struct {
	SchemaVersion string            `json:"schemaVersion"`
	Coordinate    RunMetaCoordinate `json:"coordinate"`
	Recipe        string            `json:"recipe"`
	Signer        RunMetaSigner     `json:"signer"`
	RunID         string            `json:"runId"`
	AICRVersion   string            `json:"aicrVersion"`
	K8sVersion    string            `json:"k8sVersion"`
	K8sConstraint string            `json:"k8sConstraint"`
	BundleDigest  string            `json:"bundleDigest"`
	EvidenceRef   string            `json:"evidenceRef"`
	RekorLogIndex *int64            `json:"rekorLogIndex,omitempty"`
	AttestedAt    string            `json:"attestedAt"`
}

type RunMetaCoordinate struct {
	Group     string `json:"group"`
	Dashboard string `json:"dashboard"`
	Tab       string `json:"tab"`
}

type RunMetaSigner struct {
	IDHash      string `json:"idHash"`
	Identity    string `json:"identity"`
	Issuer      string `json:"issuer"`
	Class       string `json:"class"`
	Allowlisted bool   `json:"allowlisted"`
}

type Series struct {
	// Recipe is the overlay metadata.name.
	Recipe string `json:"recipe"`

	// Builds maps each signer-id-hash to its build columns, newest first.
	Builds map[string][]SeriesBuild `json:"builds"`

	// Health maps each signer-id-hash to its derived run-health summary.
	Health map[string]SeriesHealth `json:"health"`
}

type SeriesBuild struct {
	ID          string `json:"id"`
	AICRVer     string `json:"aicrVer"`
	K8sVer      string `json:"k8sVer"`
	When        string `json:"when"`
	Newest      bool   `json:"newest"`
	EvidenceRef string `json:"evidenceRef"`

	// Results maps every CTRF name in the recipe's union test set to this
	// build's outcome: "pass", "fail", or "not-run".
	Results map[string]string `json:"results"`
}

type SeriesHealth struct {
	// FlakePct is the percentage of build-to-build result transitions across
	// the recipe's union test set (0 when there is at most one build).
	FlakePct int `json:"flakePct"`

	// LastPassBuild is the newest build id in which every test this signer ran
	// passed, or "" when none.
	LastPassBuild string `json:"lastPassBuild"`

	// Builds is the number of build columns shown.
	Builds int `json:"builds"`
}

type SignerResult struct {
	// SignerID is the distinct-signer counting key: the verified (issuer,
	// identity) pair (see signerIdentityKey), never a contributor-controlled
	// IDHash. Duplicate SignerIDs are collapsed by the defensive de-dup below
	// (the anti-sybil guarantee that one identity is one signer); callers should
	// still pre-reduce to latest-per-signer.
	SignerID string

	// Allowlisted reports whether this signer's verified identity is on the
	// in-tree allowlist. Only allowlisted signers carry corroboration weight;
	// an unallowlisted signer is a zero-weight "reported" dot.
	Allowlisted bool

	// Result is the bucketed outcome (see BucketStatus).
	Result Result
}

type Source struct {
	// Label is the human-readable source name.
	Label string `json:"label"`

	// Class is the derived source class: first-party | community | partner.
	Class string `json:"class"`

	// Allowlisted reports whether the source carries corroboration weight.
	// A false value renders as a zero-weight "reported" dot.
	Allowlisted bool `json:"allowlisted"`

	// SignerID is the verified OIDC identity (the human-auditable count key).
	SignerID string `json:"signerId"`
}

type State string

type Tab struct {
	// Recipe is the overlay metadata.name (the series-file slug).
	Recipe string `json:"recipe"`

	// Coord is the full five-dimension criteria for display and facet
	// filtering (service, accelerator, os, intent, platform).
	Coord map[string]string `json:"coord"`

	// Versions holds one baked consensus grid per AICR version present in the
	// evidence, newest-first.
	Versions []TabVersion `json:"versions"`
}

type TabVersion struct {
	// AICRVer is the AICR version this grid's consensus was computed at.
	AICRVer string `json:"aicrVer"`

	// PhaseRollup maps each phase to its worst-first rollup state.
	PhaseRollup map[string]string `json:"phaseRollup"`

	// Tests is the per-row grid, ordered by PhaseOrder then CTRF name.
	Tests []Row `json:"tests"`
}