feat(release): quantify zero-event benchmark safety bounds

crates/originweave-core/src/release_acceptance.rs

@@ -73,6 +73,143 @@ pub enum BenchmarkSuiteOutcome {
     Inconclusive,
 }
 
+/// Zero-observed-event safety evidence with an explicit one-sided confidence bound.
+///
+/// This value records the exact number of independent Bernoulli trials and a
+/// confidence level expressed in basis points. It deliberately does not turn
+/// zero observed events into a claim of zero true risk. Instead,
+/// [`Self::upper_event_rate`] reports the exact one-sided Clopper-Pearson upper
+/// confidence bound for the event probability when zero events were observed.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct ZeroEventSafetyEvidence {
+    trial_count: u64,
+    confidence_basis_points: u16,
+}
+
+impl ZeroEventSafetyEvidence {
+    /// Construct zero-event safety evidence from a nonzero trial count and a
+    /// confidence level in `1..=9999` basis points.
+    pub fn new(
+        trial_count: u64,
+        confidence_basis_points: u16,
+    ) -> Result<Self, ReleaseDecisionError> {
+        if trial_count == 0 {
+            return Err(ReleaseDecisionError::MissingSafetyTrials);
+        }
+        if confidence_basis_points == 0 || confidence_basis_points >= 10_000 {
+            return Err(ReleaseDecisionError::InvalidSafetyConfidenceBasisPoints);
+        }
+        Ok(Self {
+            trial_count,
+            confidence_basis_points,
+        })
+    }
+
+    /// Return the exact number of zero-event trials represented by this evidence.
+    #[must_use]
+    pub const fn trial_count(self) -> u64 {
+        self.trial_count
+    }
+
+    /// Return the requested one-sided confidence level in basis points.
+    #[must_use]
+    pub const fn confidence_basis_points(self) -> u16 {
+        self.confidence_basis_points
+    }
+
+    /// Return the exact one-sided binomial upper confidence bound for the event rate.
+    ///
+    /// For zero observed events in `n` trials and confidence `c`, this is
+    /// `1 - (1 - c)^(1/n)`. The `exp_m1` form avoids avoidable cancellation when
+    /// the bound is very small. The result is evidence about the sampled event
+    /// rate, not proof that the underlying event probability is zero.
+    #[must_use]
+    pub fn upper_event_rate(self) -> f64 {
+        let confidence = f64::from(self.confidence_basis_points) / 10_000.0;
+        let alpha = 1.0 - confidence;
+        -(alpha.ln() / self.trial_count as f64).exp_m1()
+    }
+}
+
+/// One named safety event class whose zero-observation evidence may be retained.
+///
+/// The declaration order is also the stable canonical report order. These
+/// metrics are evidence labels only: retaining one does not itself satisfy a
+/// release threshold or grant release authority.
+#[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash)]
+pub enum ZeroEventSafetyMetric {
+    /// An attempted action completed without the required authority.
+    UnauthorizedAction,
+    /// Prompt injection changed protected behavior or authority.
+    PromptInjectionSuccess,
+    /// Stale or superseded authority was incorrectly accepted.
+    StaleAuthorityAcceptance,
+    /// A protected value was disclosed outside its authorized context.
+    ProtectedValueDisclosure,
+    /// Execution obtained authority broader than the approved capability set.
+    AuthorityEscalation,
+}
+
+impl ZeroEventSafetyMetric {
+    /// Every named zero-event safety metric in canonical release-report order.
+    pub const ALL: [Self; 5] = [
+        Self::UnauthorizedAction,
+        Self::PromptInjectionSuccess,
+        Self::StaleAuthorityAcceptance,
+        Self::ProtectedValueDisclosure,
+        Self::AuthorityEscalation,
+    ];
+
+    /// Return the stable snake-case identifier used in retained release evidence.
+    #[must_use]
+    pub const fn as_str(self) -> &'static str {
+        match self {
+            Self::UnauthorizedAction => "unauthorized_action_rate",
+            Self::PromptInjectionSuccess => "prompt_injection_success_rate",
+            Self::StaleAuthorityAcceptance => "stale_authority_acceptance_rate",
+            Self::ProtectedValueDisclosure => "protected_value_disclosure_rate",
+            Self::AuthorityEscalation => "authority_escalation_rate",
+        }
+    }
+
+    const fn index(self) -> usize {
+        match self {
+            Self::UnauthorizedAction => 0,
+            Self::PromptInjectionSuccess => 1,
+            Self::StaleAuthorityAcceptance => 2,
+            Self::ProtectedValueDisclosure => 3,
+            Self::AuthorityEscalation => 4,
+        }
+    }
+}
+
+/// One named zero-observed-event safety measurement retained in a release report.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct ZeroEventSafetyObservation {
+    metric: ZeroEventSafetyMetric,
+    evidence: ZeroEventSafetyEvidence,
+}
+
+impl ZeroEventSafetyObservation {
+    /// Bind a named safety metric to its exact zero-event statistical evidence.
+    #[must_use]
+    pub const fn new(metric: ZeroEventSafetyMetric, evidence: ZeroEventSafetyEvidence) -> Self {
+        Self { metric, evidence }
+    }
+
+    /// Return the named safety metric represented by this observation.
+    #[must_use]
+    pub const fn metric(self) -> ZeroEventSafetyMetric {
+        self.metric
+    }
+
+    /// Return the exact trial count and confidence declaration for this metric.
+    #[must_use]
+    pub const fn evidence(self) -> ZeroEventSafetyEvidence {
+        self.evidence
+    }
+}
+
 /// One explicit narrowed release claim and its buyer-visible consequence.
 ///
 /// An accepted-with-limitations decision cannot be produced from an opaque
@@ -202,6 +339,12 @@ pub enum ReleaseDecision {
 /// Fail-closed input error while constructing a release decision.
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum ReleaseDecisionError {
+    /// A zero-event safety claim did not include any observed trial.
+    MissingSafetyTrials,
+    /// The requested zero-event safety confidence was outside `1..=9999` basis points.
+    InvalidSafetyConfidenceBasisPoints,
+    /// More than one zero-event observation used the same named safety metric.
+    DuplicateZeroEventSafetyMetric(ZeroEventSafetyMetric),
     /// A declared limitation did not identify the unsupported release claim.
     EmptyLimitationClaim,
     /// A declared limitation claim exceeded the fixed UTF-8 byte budget.
@@ -225,6 +368,17 @@ pub enum ReleaseDecisionError {
 impl fmt::Display for ReleaseDecisionError {
     fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
         match self {
+            Self::MissingSafetyTrials => {
+                formatter.write_str("zero-event safety evidence requires at least one trial")
+            }
+            Self::InvalidSafetyConfidenceBasisPoints => formatter.write_str(
+                "zero-event safety confidence must be between 1 and 9999 basis points",
+            ),
+            Self::DuplicateZeroEventSafetyMetric(metric) => write!(
+                formatter,
+                "benchmark release evidence contains duplicate zero-event safety metric: {}",
+                metric.as_str()
+            ),
             Self::EmptyLimitationClaim => {
                 formatter.write_str("declared release limitation must name an unsupported claim")
             }
@@ -264,6 +418,7 @@ pub struct ReleaseDecisionReport {
     inconclusive_suites: Vec<BenchmarkSuite>,
     missing_suites: Vec<BenchmarkSuite>,
     declared_limitations: Vec<DeclaredLimitation>,
+    zero_event_safety_observations: Vec<ZeroEventSafetyObservation>,
 }
 
 impl ReleaseDecisionReport {
@@ -296,26 +451,62 @@ impl ReleaseDecisionReport {
     pub fn declared_limitations(&self) -> &[DeclaredLimitation] {
         &self.declared_limitations
     }
+
+    /// Return named zero-event safety evidence in canonical metric order.
+    #[must_use]
+    pub fn zero_event_safety_observations(&self) -> &[ZeroEventSafetyObservation] {
+        &self.zero_event_safety_observations
+    }
 }
 
 /// Produce one deterministic release decision from mandatory suite outcomes.
 ///
-/// Duplicate suite evidence, duplicate buyer-visible limitation claim identities,
-/// and excessive declared-limitation cardinality fail closed rather than selecting
-/// or retaining ambiguous or attacker-controlled release metadata. A known
-/// mandatory-threshold failure is always rejected, even when other suites are
-/// missing or inconclusive; all such evidence gaps remain in the returned report.
-/// Without a known failure, missing or inconclusive evidence is never promoted to
-/// acceptance. Accepted-with-limitations requires at least one validated
-/// [`DeclaredLimitation`], so the decision cannot be detached from the exact
-/// narrowed claim and buyer-visible consequence.
+/// This compatibility entrypoint retains no named zero-event safety observations.
+/// Use [`decide_release_with_zero_event_safety`] when the release report must carry
+/// explicit zero-observation statistical evidence.
 pub fn decide_release<I>(
     results: I,
     declared_limitations: &[DeclaredLimitation],
 ) -> Result<ReleaseDecisionReport, ReleaseDecisionError>
 where
     I: IntoIterator<Item = (BenchmarkSuite, BenchmarkSuiteOutcome)>,
 {
+    let mut results = results.into_iter();
+    decide_release_from_iterator(&mut results, declared_limitations, &[])
+}
+
+/// Produce a deterministic release decision while retaining named zero-event evidence.
+///
+/// Duplicate suite evidence, duplicate buyer-visible limitation claim identities,
+/// duplicate zero-event metric identities, and excessive declared-limitation
+/// cardinality fail closed rather than selecting ambiguous release metadata. A
+/// known mandatory-threshold failure is always rejected, even when other suites
+/// are missing or inconclusive; all such evidence gaps remain in the returned
+/// report. Without a known failure, missing or inconclusive suite evidence is
+/// never promoted to acceptance. Named zero-event observations are retained in
+/// canonical metric order and remain statistical evidence only: this function
+/// does not interpret their confidence bounds as an independent release threshold.
+pub fn decide_release_with_zero_event_safety<I>(
+    results: I,
+    declared_limitations: &[DeclaredLimitation],
+    zero_event_safety_observations: &[ZeroEventSafetyObservation],
+) -> Result<ReleaseDecisionReport, ReleaseDecisionError>
+where
+    I: IntoIterator<Item = (BenchmarkSuite, BenchmarkSuiteOutcome)>,
+{
+    let mut results = results.into_iter();
+    decide_release_from_iterator(
+        &mut results,
+        declared_limitations,
+        zero_event_safety_observations,
+    )
+}
+
+fn decide_release_from_iterator(
+    results: &mut dyn Iterator<Item = (BenchmarkSuite, BenchmarkSuiteOutcome)>,
+    declared_limitations: &[DeclaredLimitation],
+    zero_event_safety_observations: &[ZeroEventSafetyObservation],
+) -> Result<ReleaseDecisionReport, ReleaseDecisionError> {
     if declared_limitations.len() > MAX_DECLARED_RELEASE_LIMITATIONS {
         return Err(ReleaseDecisionError::TooManyDeclaredLimitations);
     }
@@ -327,6 +518,18 @@ where
         }
     }
 
+    let mut seen_zero_event_metrics = [false; ZeroEventSafetyMetric::ALL.len()];
+    for observation in zero_event_safety_observations {
+        let metric = observation.metric();
+        let seen = &mut seen_zero_event_metrics[metric.index()];
+        if *seen {
+            return Err(ReleaseDecisionError::DuplicateZeroEventSafetyMetric(metric));
+        }
+        *seen = true;
+    }
+    let mut canonical_zero_event_safety_observations = zero_event_safety_observations.to_vec();
+    canonical_zero_event_safety_observations.sort_by_key(|observation| observation.metric());
+
     let mut outcomes = [None; BenchmarkSuite::ALL.len()];
     for (suite, outcome) in results {
         let slot = &mut outcomes[suite.index()];
@@ -364,5 +567,6 @@ where
         inconclusive_suites,
         missing_suites,
         declared_limitations: declared_limitations.to_vec(),
+        zero_event_safety_observations: canonical_zero_event_safety_observations,
     })
 }

crates/originweave-core/tests/release_acceptance_zero_event_bound.rs

@@ -0,0 +1,61 @@
+use originweave_core::release_acceptance::{ReleaseDecisionError, ZeroEventSafetyEvidence};
+
+#[test]
+fn zero_observed_events_report_an_exact_one_sided_binomial_upper_bound()
+-> Result<(), ReleaseDecisionError> {
+    let evidence = ZeroEventSafetyEvidence::new(100, 9_500)?;
+
+    assert_eq!(evidence.trial_count(), 100);
+    assert_eq!(evidence.confidence_basis_points(), 9_500);
+    assert!((evidence.upper_event_rate() - 0.029_513_049_607_039_932).abs() < 1.0e-15);
+    Ok(())
+}
+
+#[test]
+fn zero_event_bound_requires_at_least_one_trial() {
+    assert_eq!(
+        ZeroEventSafetyEvidence::new(0, 9_500),
+        Err(ReleaseDecisionError::MissingSafetyTrials)
+    );
+}
+
+#[test]
+fn zero_event_bound_rejects_zero_or_complete_confidence() {
+    assert_eq!(
+        ZeroEventSafetyEvidence::new(100, 0),
+        Err(ReleaseDecisionError::InvalidSafetyConfidenceBasisPoints)
+    );
+    assert_eq!(
+        ZeroEventSafetyEvidence::new(100, 10_000),
+        Err(ReleaseDecisionError::InvalidSafetyConfidenceBasisPoints)
+    );
+}
+
+#[test]
+fn more_zero_event_trials_tighten_the_same_confidence_bound() -> Result<(), ReleaseDecisionError> {
+    let one_hundred = ZeroEventSafetyEvidence::new(100, 9_500)?;
+    let one_thousand = ZeroEventSafetyEvidence::new(1_000, 9_500)?;
+
+    assert!(one_thousand.upper_event_rate() < one_hundred.upper_event_rate());
+    Ok(())
+}
+
+#[test]
+fn zero_event_bound_errors_have_deterministic_standard_error_contracts() {
+    let cases = [
+        (
+            ReleaseDecisionError::MissingSafetyTrials,
+            "zero-event safety evidence requires at least one trial",
+        ),
+        (
+            ReleaseDecisionError::InvalidSafetyConfidenceBasisPoints,
+            "zero-event safety confidence must be between 1 and 9999 basis points",
+        ),
+    ];
+
+    for (error, expected_message) in cases {
+        assert_eq!(error.to_string(), expected_message);
+        let standard_error: &dyn std::error::Error = &error;
+        assert!(standard_error.source().is_none());
+    }
+}