//! `xmss-verify-core`: the offline-testable REFERENCE model of the per-validator
//! inner logic of Aere Network's Post-Quantum Finality Certificate aggregation
//! zkVM circuit (research item #4).
//!
//! # What this crate IS
//!
//! An RFC 8391 XMSS-SHA2_10_256 signature-VERIFICATION core: WOTS+ one-time
//! signature verification plus the XMSS Merkle authentication-path check that
//! recovers a validator's long-term root public key. This is precisely the
//! computation the aggregation guest runs FOR EACH validator when it proves that a
//! quorum of validators hash-based-signed a finalized block. It is `no_std`,
//! allocation-free, float-free, hash-only, and deterministic: the exact shape a
//! zkVM circuit needs. See `xmss.rs`.
//!
//! It is validated against the OFFICIAL github.com/XMSS/xmss-reference known-answer
//! vector committed at `aerenew/contracts/test/fixtures/xmss-sha2_10_256-kat.json`,
//! the same vector the already-deployed on-chain `AereXmssVerifier.sol` and its
//! independent JS oracle use. See `tests/kat.rs`.
//!
//! # What this crate IS NOT (the honest boundary)
//!
//! This is the VERIFICATION CORE only. It is NOT the zkVM guest, NOT the SP1
//! aggregation program, NOT a proof of anything. The full off-chain aggregation
//! circuit (recover N roots, check committee membership, count a >= ceil(2N/3)
//! quorum, emit the on-chain verifier's 192-byte public values) and its SP1
//! proving pipeline are NOT implemented and are `[MEASURE]` multi-week specialist
//! work. See `../../docs/AERE-XMSS-AGGREGATION-CIRCUIT.md`.
//!
//! Nothing here changes Aere consensus, which stays classical ECDSA QBFT. This is
//! the ADDITIVE post-quantum finality-attestation read path only. PQ finality is
//! NOT live end to end.
//!
//! # Hash backend
//!
//! `sha256.rs` is a dependency-free `no_std` SHA-256 so `cargo test` runs fully
//! offline and deterministically. A production SP1 guest swaps in the SP1-patched
//! `sha2` crate (the accelerated precompile); the output bytes are identical, only
//! the in-circuit cost changes.

#![no_std]

pub mod sha256;
pub mod xmss;
pub mod vectors;

pub use xmss::{
    chain_lengths, xmss_recover_root, xmss_verify, Hash, XmssPubKey, XmssSig, H, LEN, N, W,
};