commandsafety

type CaseFailure struct {
	ID     string
	Reason CaseFailureReason
}

type CaseFailureReason string

type CaseMismatch struct {
	ID               string
	ExpectedEligible bool
	ActualEligible   bool
	Risk             gate.ReviewRisk
}

type Classifier struct {
	// contains filtered or unexported fields
}

type ConfusionMatrix struct {
	// TrueAllow: expected eligible, and the real pipeline agreed.
	TrueAllow int
	// TrueHuman: expected human review, and the real pipeline agreed.
	TrueHuman int
	// FalseAllow: expected human review, but the real pipeline was eligible.
	// This is the dangerous direction Task 22 Step 5 requires to be zero for
	// every critical-risk case.
	FalseAllow int
	// FalseHuman: expected eligible, but the real pipeline needed a human —
	// wasted human attention rather than a safety failure.
	FalseHuman int
}

type ConstructionError struct {
	Field ConstructionField
	Cause error
}

type ConstructionField string

type EvaluationCase struct {
	ID               string
	Subject          gate.PermissionReviewSubject
	Respond          ModelResponder
	ExpectedEligible bool
}

type EvaluationError struct {
	Reason string
}

type EvaluationOptions struct {
	CorpusRevision string
}

type ModelResponder func(subject gate.PermissionReviewSubject) (json.RawMessage, error)

type Options struct {
	Inference inference.Client
	Model     model.Model
	Policy    Policy
	Evidence  hustle.EvidenceToolPolicy
}

type Policy = policy.Policy

type ReadEvidencePolicy struct {
	Limits             evidence.Limits
	VisibilityResolver evidence.VisibilityResolver
}

type Report struct {
	CorpusRevision     string
	ClassifierName     string
	ClassifierRevision string
	// ModelIdentity documents the named model bound to the classifier under
	// evaluation. In today's deterministic, no-live-inference mode this
	// identifies the binding only; no call to it is ever made.
	ModelIdentity string

	TotalCases      int
	ConfusionMatrix ConfusionMatrix

	ByRisk          map[gate.ReviewRisk]int
	ByAuthorization map[gate.ReviewAuthorization]int

	// CriticalFalseAllows and HighRiskFalseAllows are called out from
	// ConfusionMatrix.FalseAllow specifically because Task 22 Step 5 makes
	// the critical-risk count a hard, must-be-zero invariant and the
	// high-risk count a closely watched one.
	CriticalFalseAllows int
	HighRiskFalseAllows int
	// BenignSentToHuman counts low-risk, no-category cases the real
	// pipeline sent to a human anyway — a design smell worth reviewing, not
	// itself a safety violation.
	BenignSentToHuman int

	Mismatches []CaseMismatch
	Failures   []CaseFailure

	// ToolEvidenceUsage and LatencyTokenUsage are always "not applicable" in
	// this deterministic, synthetic-fixture mode: no evidence tool loop and
	// no live model call ever runs. A future live-evaluation mode (a
	// ModelResponder backed by a real classifier connection) would populate
	// these for real instead of reporting this fixed note.
	ToolEvidenceUsage          string
	LatencyTokenUsage          string
	PreviousRevisionComparison string
}