#!/usr/bin/env python3
from __future__ import annotations

import hashlib
import json
import os
import stat
import subprocess
from pathlib import Path
from typing import Any

HERE = Path(__file__).resolve().parent
ROOT = Path(__file__).resolve().parents[3]
PROFILE = Path("/home/cube/.hermes/profiles/dualcoachtest")
PLAN = ROOT / "plans/dualcoach-production-readiness.md"
EXPECTED = {
    "plan_sha256": "d816dbbd6a27d5826b251d279a9831de096ef7cd79b5fd131ceff7253b7369be",
    "candidate_digest": "2e0894eac92bc396cc4723bf1f18ebc653b95018dd41574df435941c235da925",
    "wheel_sha256": "af4a9d0a1ffffb6eb7551c1d6dc2b32853ca6d024332a4f8f5702bbf992f141b",
    "replacement_authorization_event_sha256": "4a3551a9bbccf9bba66ff6b6cfd9500e8e30db65b6244032af4972ea475511ef",
    "baseline_readiness_sha256": "16497e3bb42dd97c66caabc4abd57aa692f32951f0c0d012d754d9988b9cde6a",
    "prior_expiry_receipt_sha256": "d906f1f79b85c897981d328e06a9bd9503a6b9cf0ca4f58852ee5ad7926cdf2d",
    "replacement_draft_sha256": "ee05174e7287a87f9c5e40dae1034cf8b3228edc6b9516df8e6349667baffc7c",
}
PRIOR_ID = "cb_v4olwxbpSQatMtVLR4QLmw"
PRIOR_HASH = "63bdc993abc7b4f0025e69b10246faf8b5f4da3b7c040f02987a77bef3fa7c59"


def sha(path: Path) -> str:
    return hashlib.sha256(path.read_bytes()).hexdigest()


def load(path: Path) -> dict[str, Any]:
    value = json.loads(path.read_text())
    assert isinstance(value, dict)
    return value


def main() -> int:
    checks: dict[str, bool] = {}
    seal_path = HERE / "permission-seal-v3.json"
    seal = load(seal_path)
    checks["permission_contract"] = all(seal.get(key) == value for key, value in EXPECTED.items())
    checks["plan"] = sha(PLAN) == EXPECTED["plan_sha256"]
    checks["harness"] = sha(HERE / "invite_harness_v3.py") == seal["harness_sha256"]
    checks["schema"] = sha(HERE / "schema-v3.json") == seal["schema_sha256"]
    checks["operations"] = sha(HERE / "OPERATIONS-v3.md") == seal["operations_sha256"]
    checks["approval"] = sha(HERE / "replacement-approval-receipt.redacted.json") == seal["approval_receipt_sha256"]
    draft = HERE / "task26-live-2e-r2-customer-draft.private.json"
    checks["private_draft"] = (
        sha(draft) == EXPECTED["replacement_draft_sha256"]
        and stat.S_IMODE(draft.stat().st_mode) == 0o600
        and not draft.is_symlink() and draft.stat().st_nlink == 1
    )
    draft_value = load(draft)
    checks["draft_authority"] = (
        draft_value.get("customer_key") == "task26_live_2e_r2_20260815_8527916639"
        and draft_value.get("customer_user_id", "missing") is None
        and len(draft_value) == 22
    )
    ledger_path = PROFILE / "data/onboarding/telegram-customer-bootstrap-v1/ledger.json"
    ledger = load(ledger_path)
    sessions = ledger.get("sessions")
    checks["one_terminal_predecessor"] = (
        isinstance(sessions, list) and len(sessions) == 1
        and sessions[0].get("session_id") == PRIOR_ID
        and sessions[0].get("sid_hash") == PRIOR_HASH
        and sessions[0].get("state") == "EXPIRED"
        and sessions[0].get("generation") == 2
        and sessions[0].get("role_claims") == []
        and sessions[0].get("recovery_attempts") == []
    )
    registry = load(PROFILE / "customers/registry.json")
    checks["empty_registry"] = registry.get("customers") == [] and registry.get("registry_mode") == "ordinary_v1"
    service = subprocess.run(
        ["systemctl", "--user", "show", "hermes-gateway-dualcoachtest.service",
         "-p", "ActiveState", "-p", "SubState", "-p", "MainPID"],
        text=True, capture_output=True, check=False,
    )
    checks["service_inactive"] = (
        service.returncode == 0 and set(service.stdout.splitlines())
        == {"ActiveState=inactive", "SubState=dead", "MainPID=0"}
    )
    source = (HERE / "invite_harness_v3.py").read_text()
    checks["event_first_and_candidate_only"] = all(fragment in source for fragment in (
        "watch = Inotify(watch_root)", "prepare_rehearsal_customer_invite",
        "event_subscription_before_prepare", "RoomBootstrapStore.expire_unbound",
        "replacement_session(after, args.session_id, args.sid_hash)",
    ))
    checks["exactly_one_replacement"] = seal.get("replacement_maximum") == 1 and seal.get("third_invite_authorized") is False
    receipt = {
        "schema": "task26-invite-harness-v3-independent-verification-v1",
        "status": "PASS" if all(checks.values()) else "FAIL",
        "checks": checks,
        "check_count": len(checks),
        "mutations": 0,
        "ready_for_exactly_one_replacement_invite": all(checks.values()),
    }
    output = HERE / "independent-verification-v3.redacted.json"
    fd = os.open(output, os.O_WRONLY | os.O_CREAT | os.O_EXCL | os.O_NOFOLLOW, 0o600)
    with os.fdopen(fd, "w") as stream:
        json.dump(receipt, stream, sort_keys=True, separators=(",", ":"))
        stream.write("\n")
    print(json.dumps(receipt, sort_keys=True))
    return 0 if all(checks.values()) else 1


if __name__ == "__main__":
    raise SystemExit(main())