#!/usr/bin/env python3
"""Read-only P04 evidence preflight. Never grants original acceptance.

This initial-phase verifier deliberately rejects unsupported semantic evidence:
D05 is pending in the dispatch, irrespective of declarations in an index.
See execution/p04-01/CHECKER_PROTOCOL.md for the supported input subset.
"""
import argparse
import hashlib
import json
import os
from pathlib import Path
import re
import subprocess
import sys

ROOT = Path(__file__).resolve().parents[1]
SPEC = ROOT / 'docs/spec/acceptance/P04-01.json'
SPEC_HASH = '9ec722e7dfb0bee178d291624a026420c08412574e238bba1fde012c7a6f7881'
DOMAINS = {'閉店', '停電', '破壊', '退出', '課金', 'シフト交代', '00:00決算'}


def require(condition, message):
    if not condition:
        raise ValueError(message)


def sha(path):
    return hashlib.sha256(path.read_bytes()).hexdigest()


def unique(pairs):
    result = {}
    for key, value in pairs:
        require(key not in result, 'duplicate JSON key: ' + key)
        result[key] = value
    return result


def load(path):
    return json.loads(path.read_text(encoding='utf-8'), object_pairs_hook=unique,
                      parse_constant=lambda x: require(False, 'nonfinite JSON: ' + x))


def safe(base, relative):
    require(isinstance(relative, str) and relative, 'invalid path')
    p = Path(relative)
    require(not p.is_absolute() and all(x not in {'.', '..'} for x in relative.split('/')),
            'unsafe path: ' + relative)
    current = base
    for part in p.parts:
        current = current / part
        require(not current.is_symlink(), 'symlink: ' + relative)
    require(current.resolve().is_relative_to(base.resolve()) and current.is_file(),
            'missing/outside file: ' + relative)
    return current


def pins(mapping, base):
    require(isinstance(mapping, dict) and mapping, 'missing pin map')
    for name, digest in mapping.items():
        require(isinstance(digest, str) and re.fullmatch('[0-9a-f]{64}', digest), 'invalid hash: ' + name)
        require(sha(safe(base, name)) == digest, 'stale pin: ' + name)


def pointer(value, path):
    require(isinstance(path, str) and (path == '' or path.startswith('/')), 'invalid JSON pointer')
    for token in path.split('/')[1:]:
        require(not re.search('~(?![01])', token), 'invalid pointer escape')
        token = token.replace('~1', '/').replace('~0', '~')
        if isinstance(value, list):
            require(re.fullmatch('0|[1-9][0-9]*', token) is not None, 'invalid array index')
            value = value[int(token)]
        else:
            require(isinstance(value, dict) and token in value, 'missing pointer: ' + path)
            value = value[token]
    return value


def literal(a, b):
    return type(a) is type(b) and json.dumps(a, sort_keys=True) == json.dumps(b, sort_keys=True)


def verify(directory):
    require(sha(SPEC) == SPEC_HASH, 'dispatch spec pin mismatch')
    spec = load(SPEC)
    evidence = directory / 'p04-evidence'
    require(not evidence.is_symlink(), 'symlink evidence directory')
    index = load(safe(evidence, 'index.json'))
    require(type(index.get('schema_version')) is int and index['schema_version'] == 1, 'schema_version')
    require(index.get('task_id') == 'P04-01' and index.get('formal_acceptance') is False, 'task/acceptance')
    head = subprocess.check_output(['git', 'rev-parse', 'HEAD'], cwd=ROOT, text=True).strip()
    require(index.get('candidate_commit') == head, 'candidate_commit mismatch')
    source = index.get('source_map')
    pins(source, ROOT)
    for name, digest in spec['current_source_pins'].items():
        require(source.get(name) == digest, 'immutable source pin: ' + name)
    oldmap = load(ROOT / 'docs/plans/original-completion-2026-10-02/execution/p04-01-input-r01/historical-source-map.json')
    required = {p for p in oldmap if p.endswith('.gd') and p.startswith(('autoload/', 'scripts/'))}
    require(required <= source.keys(), 'missing runtime/service dependency source pins')
    environment = index.get('environment')
    require(isinstance(environment, dict) and isinstance(environment.get('os'), str) and environment['os'], 'environment OS')
    for kind in ('engine', 'configuration', 'inputs'):
        pins(environment.get(kind), evidence)
    artifacts = index.get('artifacts')
    require(isinstance(artifacts, dict) and artifacts, 'missing artifacts')
    paths, raw = set(), {}
    for aid, item in artifacts.items():
        require(isinstance(aid, str) and aid and isinstance(item, dict), 'invalid artifact')
        path = safe(evidence, item['path'])
        require(path not in paths, 'duplicate artifact path')
        paths.add(path)
        require(type(item.get('bytes')) is int and item['bytes'] == path.stat().st_size, 'artifact size: ' + aid)
        require(sha(path) == item.get('sha256'), 'artifact hash: ' + aid)
        require(item.get('type') in {'observation', 'state', 'receipt', 'stdout', 'native_log', 'save', 'authority'}, 'artifact type')
        raw[aid] = path
    authority = index.get('authority')
    require(isinstance(authority, dict) and authority, 'missing authority')
    domains = index.get('domains')
    require(isinstance(domains, dict) and set(domains) == DOMAINS, 'required seven domains')
    for name, domain in domains.items():
        require(isinstance(domain, dict), 'invalid domain: ' + name)
        for field in ('source_refs', 'authority_refs', 'cases', 'invariants'):
            require(isinstance(domain.get(field), list) and domain[field], name + ': missing ' + field)
        require(domain.get('applicability') == {'source_map': source, 'environment': environment}, name + ': applicability mismatch')
        for ref in domain['source_refs']:
            require(isinstance(ref, dict) and ref.get('path') in source and isinstance(ref.get('function'), str) and ref['function'], 'invalid source ref')
            require(ref.get('sha256') == source[ref['path']], 'source ref hash')
        for ref in domain['authority_refs']:
            require(ref in authority and authority[ref].get('status') in {'original', 'approved'}, 'pending/missing authority')
            require(authority[ref].get('artifact_id') in raw, 'missing raw authority')
        case_ids = set()
        for case in domain['cases']:
            require(isinstance(case, dict) and isinstance(case.get('id'), str) and case['id'] not in case_ids, 'duplicate/invalid case')
            case_ids.add(case['id'])
            for field in ('input', 'before', 'operation', 'after', 'receipt'):
                require(case.get(field) in raw, name + ': missing case artifact ' + field)
            receipt = load(raw[case['receipt']])
            pid = receipt.get('start_pid')
            require(type(pid) is int and pid > 0 and receipt.get('end_pid') == pid and type(receipt.get('exit_code')) is int and receipt['exit_code'] == 0 and receipt.get('engine_ended') is True, 'unexecuted/incomplete receipt')
            require(receipt.get('source_map') == source and receipt.get('environment') == environment, 'receipt applicability')
            for field in ('stdout', 'native_log'):
                require(receipt.get(field) in raw, 'receipt missing raw ' + field)
        for pred in domain['invariants']:
            require(isinstance(pred, dict) and pred.get('artifact_id') in raw, 'missing predicate artifact')
            require(pred.get('authority_ref') in domain['authority_refs'], 'predicate authority')
            require(pred.get('raw_origin') == 'engine', 'unsupported derivation/origin')
            value = pointer(load(raw[pred['artifact_id']]), pred['json_pointer'])
            op = pred.get('operator')
            if op in {'same_literal', 'distinct'}:
                require(pred.get('paired_artifact_id') in raw, 'missing paired artifact')
                other = pointer(load(raw[pred['paired_artifact_id']]), pred['paired_json_pointer'])
                result = literal(value, other) if op == 'same_literal' else not literal(value, other)
            elif op == 'eq':
                result = literal(value, pred['expected'])
            elif op == 'nonnegative':
                result = type(value) in (int, float) and value >= 0
            elif op == 'count_eq':
                result = isinstance(value, (list, dict)) and type(pred.get('expected')) is int and len(value) == pred['expected']
            else:
                raise ValueError('unsupported predicate: ' + str(op))
            require(result, name + ': predicate failed')
    require(index.get('review_status') in {'pending_review', 'approved'}, 'review status')
    # Raw observation claims cannot establish production provenance, mandatory
    # scenario coverage or an approval absent from this immutable dispatch.
    raise ValueError('D05 pending: closure service / final shift interval; semantic coverage and native provenance require independent raw-evidence review. Machine gate unavailable; original acceptance not granted.')


def main():
    parser = argparse.ArgumentParser(description=__doc__)
    parser.add_argument('--verify-only', action='store_true', required=True)
    parser.parse_args()
    try:
        require(bool(os.environ.get('BUILD_OUTPUT_DIR')), 'BUILD_OUTPUT_DIR required')
        verify(Path(os.environ['BUILD_OUTPUT_DIR']))
    except (ValueError, OSError, KeyError, TypeError, IndexError, subprocess.SubprocessError) as exc:
        print(json.dumps({'task_id': 'P04-01', 'machine_verified': False, 'formal_acceptance': False, 'error': str(exc)}, ensure_ascii=False))
        return 1
    return 1


if __name__ == '__main__':
    sys.exit(main())