#!/usr/bin/env python3
from __future__ import annotations

import hashlib
import json
import stat
import sys
from pathlib import Path


def canonical(value: object) -> bytes:
    return json.dumps(value, ensure_ascii=False, sort_keys=True, separators=(",", ":")).encode()


def sha(path: Path) -> str:
    return hashlib.sha256(path.read_bytes()).hexdigest()


def main() -> int:
    root = Path(sys.argv[1]).resolve(strict=True)
    manifest = json.loads((root / "candidate-manifest.json").read_text(encoding="utf-8"))
    binding = manifest["binding"]
    candidate = hashlib.sha256(canonical(binding)).hexdigest()
    if candidate != manifest["candidate_digest"]:
        raise ValueError("candidate binding digest mismatch")
    expected = {
        "profile_full": {"passed": 749, "failed": 0},
        "gateway_full": {"passed": 8285, "skipped": 59, "failed": 0},
        "focused_source": {"passed": 105, "failed": 0},
        "focused_installed": {"passed": 105, "failed": 0},
        "golden_verifier_tests": {"passed": 49, "failed": 0},
        "related_installed": {"passed": 76, "failed": 0},
    }
    if any(manifest["gates"].get(key) != value for key, value in expected.items()):
        raise ValueError("suite count gate mismatch")
    for relative, expected_hash in binding["artifact_hashes"].items():
        if sha(root / relative) != expected_hash:
            raise ValueError(f"bound artifact changed: {relative}")
    golden = json.loads((root / "seals/golden-contract-summary.json").read_text(encoding="utf-8"))
    required = {
        "status": "ACTUAL_INSTALLED_GOLDEN_PATH_PASS",
        "natural_answer_count": 22,
        "activity_category": "moderate",
        "clarification_issue_count": 0,
        "clarification_reask_count": 0,
        "transport_call_count": 1,
        "surface_receipt_count": 1,
        "checkin_count": 1,
        "generation_count": 7,
        "capability_status": "consumed",
        "duplicate_claim_rejected": True,
        "cleanup_phase": "committed",
        "service_state": "paused",
    }
    if any(golden.get(key) != value for key, value in required.items()):
        raise ValueError("installed Golden Path contract mismatch")
    terminal = golden["terminal_inventory"]
    if not terminal["terminal"] or any(terminal[key] for key in ("active_count", "pending_count", "unknown_count", "orphan_count")):
        raise ValueError("terminal inventory mismatch")
    if stat.S_IMODE(root.stat().st_mode) not in {0o700, 0o500}:
        raise ValueError("evidence root is not private")
    result = {
        "schema": "independent-closed-choice-installed-candidate-v1",
        "status": "INSTALLED_GOLDEN_PATH_PASS",
        "candidate_digest": candidate,
        "product_digest": manifest["product_digest"],
        "golden_runtime_candidate_digest": manifest["golden_runtime_candidate_digest"],
        "gateway": expected["gateway_full"],
        "profile": expected["profile_full"],
    }
    print(json.dumps(result, sort_keys=True, separators=(",", ":")))
    return 0


if __name__ == "__main__":
    raise SystemExit(main())