#!/usr/bin/env python3
from __future__ import annotations
import hashlib, json, stat, sys
from pathlib import Path

def canonical(value: object) -> bytes:
    return json.dumps(value, ensure_ascii=False, sort_keys=True, separators=(",", ":")).encode()

def sha(path: Path) -> str:
    return hashlib.sha256(path.read_bytes()).hexdigest()

def main() -> int:
    root=Path(sys.argv[1]).resolve(strict=True)
    manifest=json.loads((root/"candidate-manifest.json").read_text())
    binding=manifest["binding"]; candidate=hashlib.sha256(canonical(binding)).hexdigest()
    if candidate!=manifest["candidate_digest"] or candidate==manifest["invalidated_candidate_digest"]: raise ValueError("candidate identity invalid")
    expected={
      "profile_full":{"passed":749,"failed":0},"gateway_full":{"passed":8286,"skipped":59,"failed":0},
      "parser_source":{"passed":13,"failed":0},"parser_installed":{"passed":13,"failed":0},
      "policy_source":{"passed":14,"failed":0},"policy_installed":{"passed":14,"failed":0},
      "focused_source":{"passed":106,"failed":0},"focused_installed":{"passed":106,"failed":0},
      "golden_verifier_tests":{"passed":49,"failed":0},"related_installed":{"passed":76,"failed":0}}
    if any(manifest["gates"].get(k)!=v for k,v in expected.items()): raise ValueError("suite count mismatch")
    for rel,digest in binding["artifact_hashes"].items():
        if sha(root/rel)!=digest: raise ValueError(f"bound artifact changed: {rel}")
    golden=json.loads((root/"seals/golden-contract-summary.json").read_text())
    required={"status":"ACTUAL_INSTALLED_GOLDEN_PATH_PASS","fixture_answer_count":22,"fixture_activity_category":"보통 수준입니다.","canonical_activity_category":"moderate","clarification_issue_count":0,"hold_count":0,"clarification_count":0,"clarification_reask_count":0,"transport_call_count":1,"surface_receipt_count":1,"checkin_count":1,"generation_count":7,"capability_status":"consumed","duplicate_claim_rejected":True,"cleanup_phase":"committed","service_state":"paused"}
    if any(golden.get(k)!=v for k,v in required.items()): raise ValueError("Golden contract mismatch")
    if golden["manual_variants"]!={"canonical_polite_passed":11,"ambiguous_unresolved":3}: raise ValueError("manual grammar matrix mismatch")
    terminal=golden["terminal_inventory"]
    if not terminal["terminal"] or any(terminal[k] for k in ("active_count","pending_count","unknown_count","orphan_count")): raise ValueError("cleanup mismatch")
    if stat.S_IMODE(root.stat().st_mode) not in {0o700,0o500}: raise ValueError("evidence root not private")
    print(json.dumps({"schema":"independent-copula-installed-candidate-v1","status":"INSTALLED_GOLDEN_PATH_PASS","candidate_digest":candidate,"product_digest":manifest["product_digest"],"golden_runtime_candidate_digest":manifest["golden_runtime_candidate_digest"],"gateway":expected["gateway_full"],"profile":expected["profile_full"]},sort_keys=True,separators=(",",":")))
    return 0
if __name__=="__main__": raise SystemExit(main())