smite-ir: Introduce affine state variables for strict state enforcement

smite-ir/src/builder.rs

@@ -71,13 +71,36 @@ impl ProgramBuilder {
                 actual_type, expected_type,
                 "{operation:?} input {i}: expected {expected_type:?}, got {actual_type:?}",
             );
+            if actual_type.is_affine() {
+                let cands = self.candidates.get_mut(&actual_type).unwrap_or_else(|| {
+                    panic!("{operation:?} input {i}: no candidates for {actual_type:?}")
+                });
+
+                // Find the position, or panic if it doesn't exist.
+                let pos = cands
+                    .iter()
+                    .position(|c| match c {
+                        Candidate::Direct(idx) => *idx == input_idx,
+                        Candidate::Extract { compound_idx, .. } => *compound_idx == input_idx,
+                    })
+                    .unwrap_or_else(|| {
+                        panic!("{operation:?} input {i}: affine {actual_type:?} already consumed")
+                    });
+
+                // Consume it.
+                cands.remove(pos);
+            }
         }
 
         let idx = self.instructions.len();
 
         if let Some(out_type) = operation.output_type() {
             // Register extractable fields for compound types.
             for (extract_op, field_type) in operation.extractable_fields() {
+                assert!(
+                    !out_type.is_affine(),
+                    "Affine variables cannot be extracted"
+                );
                 self.candidates
                     .entry(field_type)
                     .or_default()
@@ -103,12 +126,27 @@ impl ProgramBuilder {
 
     /// Selects or creates a variable of the given type using probabilistic
     /// variable selection (75% most recent, 15% any existing, 10% fresh).
-    #[allow(clippy::missing_panics_doc)] // candidates is always non-empty
+    ///
+    /// # Panics
+    ///
+    /// Panics in the following scenarios:
+    /// * An affine type is requested but its candidate pool is empty (all instances have been consumed).
+    /// * Attempts to generate a fresh variable for a type that cannot be instantiated out-of-thin-air
+    ///   (e.g., `Message`, `AcceptChannel`, or affine types).
+    /// * Resolving the chosen candidate triggers a panic in the underlying `append` operation.
     pub fn pick_variable(&mut self, var_type: VariableType, rng: &mut impl Rng) -> usize {
-        let Some(candidates) = self.candidates.get(&var_type) else {
+        let Some(candidates) = self.candidates.get_mut(&var_type) else {
             return self.generate_fresh(var_type, rng);
         };
 
+        if var_type.is_affine() {
+            let chosen_candidate = candidates
+                .last()
+                .unwrap_or_else(|| panic!("no candidates for {var_type:?}"))
+                .clone();
+            return self.resolve_candidate(chosen_candidate);
+        }
+
         let roll = rng.random_range(0..20);
         match roll {
             // 10%: generate a fresh value even though candidates exist.
@@ -168,12 +206,18 @@ impl ProgramBuilder {
             VariableType::Message => {
                 panic!("cannot generate fresh Message: requires composed inputs")
             }
+            VariableType::OpenChannelMessage => {
+                panic!("cannot generate fresh OpenChannelMessage: requires composed inputs")
+            }
             VariableType::AcceptChannel => {
                 panic!("cannot generate fresh AcceptChannel: requires protocol interaction")
             }
             VariableType::FundingTransaction => {
                 panic!("cannot generate fresh FundingTransaction: requires composed inputs")
             }
+            VariableType::SentOpenChannel => {
+                panic!("cannot generate fresh affine type")
+            }
         }
     }
 

smite-ir/src/generators/open_channel.rs

@@ -48,7 +48,7 @@ impl Generator for OpenChannelGenerator {
         let channel_type = builder.append(Operation::LoadChannelType(variant), &[]);
 
         // Build and send open_channel.
-        let msg = builder.append(
+        let open_channel_msg = builder.append(
             Operation::BuildOpenChannel,
             &[
                 chain_hash,
@@ -73,9 +73,9 @@ impl Generator for OpenChannelGenerator {
                 channel_type,
             ],
         );
-        builder.append(Operation::SendMessage, &[msg]);
+        let sent_open_channel = builder.append(Operation::SendOpenChannel, &[open_channel_msg]);
 
         // Receive accept_channel.
-        builder.append(Operation::RecvAcceptChannel, &[]);
+        builder.append(Operation::RecvAcceptChannel, &[sent_open_channel]);
     }
 }

smite-ir/src/mutators/input_swap.rs

@@ -19,7 +19,16 @@ impl Mutator for InputSwapMutator {
             .instructions
             .iter()
             .enumerate()
-            .flat_map(|(i, instr)| (0..instr.inputs.len()).map(move |j| (i, j)))
+            .flat_map(|(i, instr)| {
+                instr
+                    .operation
+                    .input_types()
+                    .into_iter()
+                    .enumerate()
+                    // Affine variables carry no data, so swapping one affine variable with
+                    // another has no practical effect.
+                    .filter_map(move |(j, ty)| (!ty.is_affine()).then_some((i, j)))
+            })
             .choose(rng)
         else {
             return false;

smite-ir/src/mutators/operation_param.rs

@@ -103,7 +103,8 @@ fn mutate_operation(op: &mut Operation, rng: &mut impl Rng) -> bool {
         | Operation::BuildChannelAnnouncement
         | Operation::SendMessage
         | Operation::RecvAcceptChannel
-        | Operation::BroadcastTransaction => {
+        | Operation::BroadcastTransaction
+        | Operation::SendOpenChannel => {
             unreachable!("is_param_mutable returned true for {op:?}")
         }
     }

smite-ir/src/operation.rs

@@ -138,6 +138,10 @@ pub enum Operation {
     /// Send an encoded message over the connection.
     /// Input: `Message`.
     SendMessage,
+    /// Send an `open_channel` message over the connection.
+    /// Produces a `SentOpenChannel` variable.
+    /// Input: `OpenChannelMessage`.
+    SendOpenChannel,
     /// Receive and parse an `accept_channel` response.
     /// Produces an `AcceptChannel` compound variable.
     RecvAcceptChannel,
@@ -590,6 +594,7 @@ impl fmt::Display for Operation {
                 format_hex(alias),
             ),
             Self::SendMessage => write!(f, "SendMessage"),
+            Self::SendOpenChannel => write!(f, "SendOpenChannel"),
         }
     }
 }
@@ -615,10 +620,12 @@ impl Operation {
             Self::LoadChainHashFromContext => Some(VariableType::ChainHash),
             Self::ExtractAcceptChannel(field) => Some(field.output_type()),
             Self::CreateFundingTransaction => Some(VariableType::FundingTransaction),
-            Self::BuildOpenChannel
-            | Self::BuildChannelAnnouncement
-            | Self::BuildNodeAnnouncement { .. } => Some(VariableType::Message),
+            Self::BuildChannelAnnouncement | Self::BuildNodeAnnouncement { .. } => {
+                Some(VariableType::Message)
+            }
+            Self::BuildOpenChannel => Some(VariableType::OpenChannelMessage),
             Self::SendMessage | Self::MineBlocks(_) | Self::BroadcastTransaction => None,
+            Self::SendOpenChannel => Some(VariableType::SentOpenChannel),
             Self::RecvAcceptChannel => Some(VariableType::AcceptChannel),
         }
     }
@@ -642,9 +649,9 @@ impl Operation {
             | Self::LoadChannelType(_)
             | Self::LoadTargetPubkeyFromContext
             | Self::LoadChainHashFromContext
-            | Self::MineBlocks(_)
-            | Self::RecvAcceptChannel => vec![],
+            | Self::MineBlocks(_) => vec![],
 
+            Self::RecvAcceptChannel => vec![VariableType::SentOpenChannel],
             Self::DerivePoint => vec![VariableType::PrivateKey],
             Self::ExtractAcceptChannel(_) => vec![VariableType::AcceptChannel],
             Self::CreateFundingTransaction => vec![
@@ -656,6 +663,8 @@ impl Operation {
             Self::SendMessage => vec![VariableType::Message],
             Self::BroadcastTransaction => vec![VariableType::FundingTransaction],
 
+            Self::SendOpenChannel => vec![VariableType::OpenChannelMessage],
+
             Self::BuildOpenChannel => vec![
                 VariableType::ChainHash,    // chain_hash
                 VariableType::ChannelId,    // temporary_channel_id
@@ -729,7 +738,8 @@ impl Operation {
             | Self::BuildNodeAnnouncement { .. }
             | Self::SendMessage
             | Self::MineBlocks(_)
-            | Self::BroadcastTransaction => vec![],
+            | Self::BroadcastTransaction
+            | Self::SendOpenChannel => vec![],
 
             Self::RecvAcceptChannel => AcceptChannelField::ALL
                 .iter()
@@ -768,7 +778,8 @@ impl Operation {
             | Self::BuildChannelAnnouncement
             | Self::SendMessage
             | Self::RecvAcceptChannel
-            | Self::BroadcastTransaction => false,
+            | Self::BroadcastTransaction
+            | Self::SendOpenChannel => false,
         }
     }
 }

smite-ir/src/program.rs

@@ -85,6 +85,14 @@ pub enum ValidateError {
         /// Actual byte length.
         len: usize,
     },
+    /// An affine variable is used more than once.
+    #[error("Variable {index}: affine {var_type:?} consumed twice (max 1)")]
+    AffineOverUse {
+        /// The overused affine variable index.
+        index: usize,
+        /// Type of the affine variable.
+        var_type: VariableType,
+    },
 }
 
 impl Program {
@@ -101,6 +109,8 @@ impl Program {
     ///
     /// Returns the first violation encountered.
     pub fn validate(&self) -> Result<(), ValidateError> {
+        let mut affine_consumed = vec![false; self.instructions.len()];
+
         for (instr_idx, instr) in self.instructions.iter().enumerate() {
             let expected = instr.operation.input_types();
             if instr.inputs.len() != expected.len() {
@@ -135,6 +145,15 @@ impl Program {
                         got: actual_type,
                     });
                 }
+                if expected_type.is_affine() {
+                    if affine_consumed[input_idx] {
+                        return Err(ValidateError::AffineOverUse {
+                            index: input_idx,
+                            var_type: expected_type,
+                        });
+                    }
+                    affine_consumed[input_idx] = true;
+                }
             }
             if let Operation::LoadBytes(b) | Operation::LoadFeatures(b) = &instr.operation
                 && b.len() > MAX_MESSAGE_SIZE