#!/usr/bin/env python3
"""Create the deterministic v6 artifact inventory and seal exactly once."""

from __future__ import annotations

import hashlib
import json
import os
from pathlib import Path

ROOT = Path(__file__).resolve().parent
SEALED = (
    "OPERATIONS.md",
    "continuous_lifecycle.py",
    "independent_verify.py",
    "observer_v64.py",
    "readiness.json",
    "seal_artifacts.py",
    "test_continuous_lifecycle.py",
    "test_observer_v64.py",
)


def digest(path: Path) -> str:
    return hashlib.sha256(path.read_bytes()).hexdigest()


def exclusive(path: Path, value: object) -> None:
    fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_EXCL | os.O_CLOEXEC, 0o600)
    try:
        os.write(fd, (json.dumps(value, sort_keys=True, separators=(",", ":")) + "\n").encode())
        os.fsync(fd)
    finally:
        os.close(fd)


def main() -> int:
    files = [{"path": name, "sha256": digest(ROOT / name)} for name in SEALED]
    inventory = {
        "schema": "task26-observer-v6.4-hash-inventory-v1",
        "files": files,
        "sealed_file_count": len(files),
    }
    exclusive(ROOT / "hash-inventory.json", inventory)
    seal = {
        "schema": "task26-continuous-lifecycle-observer-v6.4-seal-v1",
        "status": "PASS_SEALED_DEPLOYED_SERVICE_STATE_FRESH_ALIAS_WAIT",
        "predecessor_root": "task26-continuous-lifecycle-observer-v6.3-f38d0373",
        "predecessor_seal_sha256": "2833428cfab41826a5cb54f90bb51c56f40b2468850d02687f7341c791b7f803",
        "candidate": "4a6c7ee54cf9526a30de8bb576c1d71b411938beba33a04914738f6e1b6ed1cb",
        "core": "3374be765c7e53fc431b0c6e48cacbacb09618f77f13ef87016cb0ad2575d060",
        "profile_wheel": "f75856d6d986b64d3d2f083aec2f865c7aea19f5950b84ff06e519f2f6505af6",
        "hermes_wheel": "9d22e89a0b1a14d4eb7f1c2005fc01860bec5f3b4eda6e01bb1390542a90b875",
        "deployment_receipt": "fe65b634396aaae2818719d1b34fdaad148b2547290d3a66b3af7803bf93dfca",
        "candidate_inventory": "0119beeb46a15ab25a78550da4c432b4cc52e0dc816822d2688dc9009df89d90",
        "service_state_sha256": "81c1e581cb84aac6f44044747e0e8e77a2d7498c71d626f1f9b5ec2f9d09a261",
        "service_state_mode": "0600",
        "service_state_schema": "customer-service-state-v1",
        "service_state": "empty-unpaused",
        "service_pid": 576011,
        "telegram": "connected",
        "fresh_alias_after_arming": "오늘 체크인",
        "expected_inline": "오늘 체크인 시작",
        "pre_arm_2026_08_17_1210": "no-state-card-not-replayed-not-accepted",
        "recovery_seal": "00d44de03e8dde668da8058091751291b13457c8bd086917dfe85e42b3813df8",
        "polling_offset_lower_bound": 629525117,
        "inventory_sha256": digest(ROOT / "hash-inventory.json"),
        "sealed_file_count": len(files),
        "tests_passed": 34,
        "timeout_defaults": {"stage": 1800, "total": 21600},
        "timeout_caps": {"stage": 21600, "total": 21600},
        "deployed_current_state": "PASS_ACTIVE_ZERO_DELIVERY_EMPTY_UNPAUSED_RECOVERED_OFFSET",
        "profile_module_parity_count": 44,
        "lsp_errors": 0,
        "ruff": "PASS",
        "compile": "PASS",
        "network_calls": 0,
        "profile_mutated": False,
        "service_actions": 0,
        "ui_actions": 0,
    }
    exclusive(ROOT / "SEAL.json", seal)
    print(json.dumps(seal, sort_keys=True))
    return 0


if __name__ == "__main__":
    raise SystemExit(main())