src/verifier.rs

use crate::opcode::Opcode;

pub fn verify_program(bytes: &[u8]) -> Result<(), String> {
    if bytes.len() % 8 != 0 {
        return Err("Program length must be multiple of 8 bytes".into());
    }

    if bytes.len() > 8192 {
        return Err("Program too large".into());
    }

    for chunk in bytes.chunks(8) {
        let opcode = Opcode::from_byte(chunk[0])
            .ok_or("Unknown opcode")?;

        if (0xE0..=0xE5).contains(&chunk[0]) {
            return Err("Constitutional violation".into());
        }

        if opcode == Opcode::CISS && chunk[5] == 0 {
            return Err("Zero credit issuance forbidden".into());
        }
    }

    Ok(())
}