#!/usr/bin/env python3
"""Independent read-only verification of final candidate, inventory, seals and clean state."""

from __future__ import annotations
import hashlib
import json
import subprocess
from pathlib import Path

ROOT = Path(__file__).resolve().parent
PROJECT = ROOT.parents[3]


def sha(p: Path) -> str:
    return hashlib.sha256(p.read_bytes()).hexdigest()


def main() -> int:
    seal = json.loads((ROOT / "SEAL.json").read_text())
    manifest = json.loads((ROOT / "candidate-manifest.json").read_text())
    rows = json.loads((ROOT / "PACKAGE-INVENTORY.json").read_text())
    assert (
        seal["status"] == "READY_STRICT_REHEARSAL"
        and manifest["status"] == "READY_STRICT_REHEARSAL"
    )
    assert seal["full_candidate_digest"] == manifest["full_candidate_digest"]
    assert seal["manifest_sha256"] == sha(ROOT / "candidate-manifest.json")
    assert seal["package_inventory_sha256"] == sha(ROOT / "PACKAGE-INVENTORY.json")
    for row in rows:
        p = ROOT / row["path"]
        assert (
            p.is_file() and p.stat().st_size == row["size"] and sha(p) == row["sha256"]
        ), p
    assert len(rows) == seal["package_entry_count"]
    for name, directory in {
        "cleanup_v4": "task26-post-lifecycle-cleanup-v4-4a6c7ee5-st_01a00e68",
        "cleanup_v5": "task26-post-lifecycle-cleanup-v5-4a6c7ee5-st_01a00ed7",
        "immutable_retention": "task26-strict-rerun-retention-st_01a00ed5",
        "capture_harness": "task26-strict-rerun-customer-surface-capture-st_01a00ed6",
    }.items():
        assert (
            sha(PROJECT / ".omo/evidence/task26" / directory / "SEAL.json")
            == seal["predecessor_seals"][name]
        )
    assert (
        sha(ROOT / "artifacts/hermes_agent-0.17.0-py3-none-any.whl")
        == seal["hermes_wheel_sha256"]
    )
    assert (
        sha(ROOT / "artifacts/physique_checkin_cli-0.1.0-py3-none-any.whl")
        == seal["profile_wheel_sha256"]
    )
    service = subprocess.check_output(
        [
            "systemctl",
            "--user",
            "show",
            "hermes-gateway-dualcoachtest.service",
            "-p",
            "ActiveState",
            "-p",
            "SubState",
            "-p",
            "MainPID",
        ],
        text=True,
    )
    assert (
        "ActiveState=inactive" in service
        and "SubState=dead" in service
        and "MainPID=0" in service
    )
    profile = Path("/home/cube/.hermes/profiles/dualcoachtest")
    assert not (profile / "customers/registry.json").exists()
    for p in (profile / "data/owner-actions", profile / "data/onboarding"):
        assert not p.exists() or not any(p.iterdir())
    print(
        json.dumps(
            {
                "status": "READY_STRICT_REHEARSAL",
                "checks": len(rows) + 12,
                "candidate": seal["full_candidate_digest"],
                "inventory_root": seal["package_inventory_sha256"],
                "clean_state": "PASS",
            },
            sort_keys=True,
        )
    )
    return 0


if __name__ == "__main__":
    raise SystemExit(main())