feat: add derivePassedFromEstimators to compute top-level pass/fail

- Introduce `derivePassedFromEstimators` function to determine the overall `Passed` status by aggregating results from IID and Non-IID estimators.
- Update gRPC server logic to use `derivePassedFromEstimators` for response construction.
- Add comprehensive unit tests to validate all scenarios of `derivePassedFromEstimators`.

Author: Christian

internal/service/derive_passed_test.go

@@ -0,0 +1,69 @@
+package service
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+
+	pb "github.com/AmmannChristian/nist-800-90b/pkg/pb"
+)
+
+func TestDerivePassedFromEstimators(t *testing.T) {
+	passed := func(name string) *pb.Sp80090BEstimatorResult {
+		return &pb.Sp80090BEstimatorResult{Name: name, Passed: true}
+	}
+	failed := func(name string) *pb.Sp80090BEstimatorResult {
+		return &pb.Sp80090BEstimatorResult{Name: name, Passed: false}
+	}
+
+	tests := []struct {
+		name      string
+		iid       []*pb.Sp80090BEstimatorResult
+		nonIID    []*pb.Sp80090BEstimatorResult
+		expectAll bool
+	}{
+		{
+			name:      "all passed",
+			iid:       []*pb.Sp80090BEstimatorResult{passed("MCV"), passed("Chi2")},
+			nonIID:    []*pb.Sp80090BEstimatorResult{passed("MCV"), passed("Collision")},
+			expectAll: true,
+		},
+		{
+			name:      "iid failure propagates",
+			iid:       []*pb.Sp80090BEstimatorResult{passed("MCV"), failed("Chi2")},
+			nonIID:    []*pb.Sp80090BEstimatorResult{passed("MCV")},
+			expectAll: false,
+		},
+		{
+			name:      "non-iid failure propagates",
+			iid:       []*pb.Sp80090BEstimatorResult{passed("MCV")},
+			nonIID:    []*pb.Sp80090BEstimatorResult{passed("MCV"), failed("Collision")},
+			expectAll: false,
+		},
+		{
+			name:      "empty results returns true",
+			iid:       nil,
+			nonIID:    nil,
+			expectAll: true,
+		},
+		{
+			name:      "only iid with failure",
+			iid:       []*pb.Sp80090BEstimatorResult{failed("MCV")},
+			nonIID:    nil,
+			expectAll: false,
+		},
+		{
+			name:      "only non-iid all passed",
+			iid:       nil,
+			nonIID:    []*pb.Sp80090BEstimatorResult{passed("MCV"), passed("Collision")},
+			expectAll: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := derivePassedFromEstimators(tt.iid, tt.nonIID)
+			assert.Equal(t, tt.expectAll, result)
+		})
+	}
+}

internal/service/grpc_server.go

@@ -134,7 +134,7 @@ func (s *GRPCServer) AssessEntropy(ctx context.Context, req *pb.Sp80090BAssessme
 		MinEntropy:        minEntropy,
 		IidResults:        iidResults,
 		NonIidResults:     nonIIDResults,
-		Passed:            true,
+		Passed:            derivePassedFromEstimators(iidResults, nonIIDResults),
 		AssessmentSummary: "NIST SP 800-90B entropy assessment completed",
 		SampleCount:       uint64(len(req.Data)),
 		BitsPerSymbol:     usedBits,
@@ -151,6 +151,23 @@ func (s *GRPCServer) AssessEntropy(ctx context.Context, req *pb.Sp80090BAssessme
 	return response, nil
 }
 
+// derivePassedFromEstimators computes the top-level Passed flag by ANDing
+// all individual estimator Passed fields across IID and Non-IID results.
+// SP 800-90B does not define a top-level pass/fail — this is product-defined.
+func derivePassedFromEstimators(iidResults, nonIIDResults []*pb.Sp80090BEstimatorResult) bool {
+	for _, r := range iidResults {
+		if !r.Passed {
+			return false
+		}
+	}
+	for _, r := range nonIIDResults {
+		if !r.Passed {
+			return false
+		}
+	}
+	return true
+}
+
 // convertEstimatorsToProto maps internal EstimatorResult values to their
 // protobuf representation. Entropy estimators include the estimate in the
 // details map; statistical tests (where the estimate is not valid) are