Create src/verifier.rs

src/verifier.rs

@@ -0,0 +1,19 @@
+use crate::opcode::Opcode;
+
+pub fn verify_program(bytes: &[u8]) -> Result<(), String> {
+    for chunk in bytes.chunks(8) {
+        let opcode = Opcode::from_byte(chunk[0])
+            .ok_or("Unknown opcode")?;
+
+        // Forbidden opcodes (constitution)
+        if (0xE0..=0xE5).contains(&(chunk[0])) {
+            return Err("Constitutional violation".into());
+        }
+
+        // Hard invariants
+        if opcode == Opcode::CISS && chunk[5] == 0 {
+            return Err("Zero credit issuance forbidden".into());
+        }
+    }
+    Ok(())
+}