av_core/
units.rs

1//! Unit-conversion constants shared workspace-wide.
2//!
3//! Every crate that mixes seconds/milliseconds or dollars/micro-dollars must
4//! use these names rather than open-coding the conversion factors — a
5//! misplaced `1_000` vs `1_000_000` was a real class of bug in earlier
6//! rounds of this review.
7
8/// Milliseconds per second.
9pub const MS_PER_SEC: u64 = 1_000;
10
11/// Milliseconds per hour.
12pub const MS_PER_HOUR: u64 = 3_600 * MS_PER_SEC;
13
14/// Milliseconds per day.
15pub const MS_PER_DAY: u64 = 24 * MS_PER_HOUR;
16
17/// Seconds per day.
18pub const SECS_PER_DAY: u64 = 24 * 3_600;
19
20/// USD micro-units per dollar. All internal cost bookkeeping stays in
21/// micro-USD (`u64`) to keep every arithmetic step in exact integers; only
22/// wire-facing serialization converts to floating point.
23pub const USD_MICROS_PER_DOLLAR: u64 = 1_000_000;
24
25/// Upper bound for cumulative `cost_usd_micros` counters, aligned with
26/// `av_atif::validate::MAX_COST_USD` (9e9 USD). Introduced in R69 to
27/// close R64 F3: the recovery folds in `av-harness/src/worker.rs`
28/// gated `cost_usd_micros` on `av_core::error::JCS_SAFE_MAX` (2^53 =
29/// ~$9.007e9 micro-scaled), while the strict ATIF validator refuses
30/// any `total_cost_usd > 9e9`. The $7.2M gap between the two ceilings
31/// (`JCS_SAFE_MAX / USD_MICROS_PER_DOLLAR = 9,007,199 USD past 9e9`)
32/// meant a hostile / drift-authenticated journal replay whose summed
33/// costs landed in the window would fold cleanly through recovery
34/// (fold says "safe"), then the very next `av_atif::write_atomic`
35/// call would strict-refuse the trajectory — the session became
36/// un-writable across every reconciler tick. Tightening the fold
37/// cost cap to `9e9 * USD_MICROS_PER_DOLLAR = 9e15 micros` (still
38/// safely below `JCS_SAFE_MAX = 9.007e15`) means any cost that
39/// passes the fold also passes ATIF strict validation.
40pub const COST_MICROS_MAX: u64 = 9_000_000_000 * USD_MICROS_PER_DOLLAR;
41
42#[cfg(test)]
43mod tests {
44    use super::*;
45
46    #[test]
47    fn factors_agree_with_first_principles() {
48        assert_eq!(MS_PER_SEC, 1_000);
49        assert_eq!(MS_PER_HOUR, 3_600_000);
50        assert_eq!(MS_PER_DAY, 86_400_000);
51        assert_eq!(SECS_PER_DAY, 86_400);
52        assert_eq!(USD_MICROS_PER_DOLLAR, 1_000_000);
53        assert_eq!(COST_MICROS_MAX, 9_000_000_000_000_000);
54        // R69 R64 F3 alignment: must be strictly below JCS_SAFE_MAX,
55        // so any cost that passes the recovery fold also passes the
56        // ATIF strict validator (which refuses total_cost_usd > 9e9).
57        // Compile-time-provable relationship — but expressing it as
58        // an assertion is the point: any future edit to either
59        // constant that widens the gap must trip this test.
60        #[allow(clippy::assertions_on_constants)]
61        {
62            assert!(COST_MICROS_MAX < crate::error::JCS_SAFE_MAX);
63        }
64    }
65}
av_core/units.rs

av_core/
units.rs
