"""Draft unsigned compact sign-off batches (INFD-WP-0002-T01).

One question per memo. No secret values. Does not submit, present, or bind.
"""
from __future__ import annotations

import hashlib
from pathlib import Path

from informed_decision.memo import (
    BindingLevel,
    BindingSlice,
    Highlight,
    Memo,
    PacketItem,
    Principal,
    Scope,
    StepKind,
)
from informed_decision.records import dumps, memo_from

ROOT = Path(__file__).resolve().parents[1] / "docs" / "batches" / "2026-09-14"
REVIEW_GROUP = "net-kingdom-admins"
PRINCIPAL = Principal(
    id="pending-human-session",
    kind="person",
    display_name="Named reviewer in net-kingdom-admins",
    role="reviewer",
)


def _sha(text: str) -> str:
    return "sha256:" + hashlib.sha256(text.encode()).hexdigest()


def _memo(*, memo_id: str, question: str, brief: str, target: Scope, packet_id: str, packet_hash: str, highlight: str, workplan: str, task: str) -> Memo:
    return Memo(
        id=memo_id,
        version=1,
        question=question,
        requested_act="approve",
        binding_level=BindingLevel.ORGANIZATIONAL,
        brief=brief,
        binding=BindingSlice(principal=PRINCIPAL, target=target),
        step_kind=StepKind.APPROVE,
        packet=(PacketItem(packet_id, packet_id, packet_hash),),
        highlights=(
            Highlight(
                id=f"{memo_id}-h1",
                item_id=packet_id,
                note=highlight,
                required_ack=True,
                severity="critical",
                locator={"kind": "work_record", "workplan": workplan, "task": task},
            ),
        ),
    )


CREDENTIALS = [
    {
        "id": "infd-20260914-c01",
        "workplan": "SECRETS-WP-0010",
        "task": "Admit and verify real native delivery",
        "task_id": "2aa6d2d3-0000-0000-0000-000000000000",
        "hub_task_id": "2aa6d2d3",
        "question": "Admit real native OpenRouter delivery for intelligence-radar on the existing reviewed lane?",
        "brief": (
            "SECRETS-WP-0010 native delivery is waiting on a human admit. "
            "KeyCape redirects pass. This memo does not display, mint, or rotate a credential. "
            "It only asks whether the already-reviewed apply/verify/exec packets may proceed to live native delivery."
        ),
        "highlight": "No secret value is in this packet. Admit is not a mint.",
        "target": Scope("secret-catalog-lane", "catalog:openrouter-llm-connect", "Existing llm-connect OpenRouter lane", "prod"),
        "packet": """# SECRETS-WP-0010 — admit native delivery

Blocking workplan: SECRETS-WP-0010
Blocking task: Admit and verify real native delivery (hub prefix 2aa6d2d3)

## Question
Admit real native OpenRouter delivery for intelligence-radar on the existing reviewed lane?

## One act
Authorize the operator in `net-kingdom-admins` to complete the already-prepared
apply / verify / exec packets. This is not a new OpenBao path and not a key mint.

## Must not
- Paste or display credential material
- Call OpenRouter inference
- Treat `ops-warden` as a secret vendor
""",
    },
    {
        "id": "infd-20260914-c02",
        "workplan": "RPF-WP-0035",
        "task": "RPF-WP-0035-T02",
        "hub_task_id": "e0c82ea9",
        "question": "Accept provisioning of the secrets-engine service JWT login on the reviewed credential lane?",
        "brief": (
            "RPF-WP-0035-T02 waits on accepting and provisioning secrets-engine service JWT login. "
            "This memo is the accept question only. Provisioning remains the platform owner's act after bind."
        ),
        "highlight": "Accept is not permission to invent a client_secret in this memo.",
        "target": Scope("credential-lane", "rpf-wp-0035-t02", "secrets-engine service JWT login", "prod"),
        "packet": """# RPF-WP-0035-T02 — accept JWT login lane

Blocking workplan: RPF-WP-0035
Blocking task: RPF-WP-0035-T02 (hub prefix e0c82ea9)

## Question
Accept provisioning of the secrets-engine service JWT login on the reviewed credential lane?

## One act
Organizational accept that this lane may be provisioned by its owner. The memo
does not contain a JWT, client secret, or OpenBao policy body.

## Must not
- Embed a token
- Collapse T02 with T03 Fluid lane or T06 reader admission
""",
    },
    {
        "id": "infd-20260914-c03",
        "workplan": "NK-WP-0032",
        "task": "NK-WP-0032-T03",
        "hub_task_id": "73b77110",
        "question": "Apply the live OpenBao role addition already specified for the operator-tunneled browser callback?",
        "brief": (
            "NK-WP-0032-T03 applies a live OpenBao role addition. This memo asks only whether that apply may proceed. "
            "The role body stays in the owning repo; it is not copied here."
        ),
        "highlight": "Apply is one role addition, not a general OpenBao admin grant.",
        "target": Scope("openbao-role", "nk-wp-0032-t03", "OpenBao role addition for operator-tunneled callback", "prod"),
        "packet": """# NK-WP-0032-T03 — apply live OpenBao role

Blocking workplan: NK-WP-0032
Blocking task: NK-WP-0032-T03 (hub prefix 73b77110)

## Question
Apply the live OpenBao role addition already specified for the operator-tunneled browser callback?

## One act
Authorize the NetKingdom owner to apply the already-specified role. This memo
does not include the policy HCL or any secret id.

## Must not
- Broaden to unattended public OpenBao UI
- Treat this as NK-WP-0032-T04 evidence return
""",
    },
    {
        "id": "infd-20260914-c04",
        "workplan": "WARDEN-WP-0027",
        "task": "WARDEN-WP-0027-T02",
        "hub_task_id": "cae498ee",
        "question": "Attend the graded lockdown / break-glass seal for ops-warden trust-root work?",
        "brief": (
            "WARDEN-WP-0027-T02 is attended seal work. This memo asks the reviewer to attend that seal sitting. "
            "ops-warden still issues SSH certificates only; this is not a request for an API key."
        ),
        "highlight": "ops-warden does not vend API keys. This is an attended seal, not a secret paste.",
        "target": Scope("trust-root", "warden-wp-0027-t02", "ops-warden graded lockdown / break-glass", "prod"),
        "packet": """# WARDEN-WP-0027-T02 — attend graded lockdown seal

Blocking workplan: WARDEN-WP-0027
Blocking task: WARDEN-WP-0027-T02 (hub prefix cae498ee)

## Question
Attend the graded lockdown / break-glass seal for ops-warden trust-root work?

## One act
Schedule/complete the attended seal. Credential routing remains: SSH certs from
ops-warden; other secrets from OpenBao via `warden route` pointers.

## Must not
- Ask ops-warden for ISSUE_CORE_API_KEY or similar
- Record seal material in this packet
""",
    },
]

DECISIONS = [
    {
        "id": "infd-20260914-d01",
        "workplan": "CUST-WP-0038",
        "task": "CUST-WP-0038-T08",
        "hub_task_id": "57412aef",
        "question": "After HA failover and restore drills pass, retire WSL2 as a State Hub fallback?",
        "brief": (
            "CUST-WP-0038-T08 requires explicit approval after drills. This memo is that approval question. "
            "It does not assert that the drills have already passed."
        ),
        "highlight": "Approve only if you accept that WSL2 leaves both normal and fallback operating models.",
        "target": Scope("operating-model", "cust-wp-0038-t08", "Retire WSL2 State Hub fallback", "prod"),
        "packet": """# CUST-WP-0038-T08 — retire WSL2 fallback

Blocking workplan: CUST-WP-0038
Blocking task: CUST-WP-0038-T08 (hub prefix 57412aef, needs_human)

## Question
After HA failover and restore drills pass, retire WSL2 as a State Hub fallback?

## One act
Founder/operator approval of the retirement once T05/T06 drills have passed.
This memo does not skip the drills.

## Must not
- Treat this accept as proof that drills already passed
- Keep WSL2 as an undeclared fallback after accept
""",
    },
    {
        "id": "infd-20260914-d02",
        "workplan": "HFACT-WP-0001",
        "task": "HFACT-WP-0001-T03",
        "hub_task_id": "67c80db1",
        "question": "Confirm the existing operator-group claim for CCR-2026-0019 as required by the factory identity/audit/approval path?",
        "brief": (
            "HFACT-WP-0001-T03 waits on NetKingdom/KeyCape confirmation of the exact existing operator-group claim. "
            "This memo is that confirmation question. It does not mint a new group."
        ),
        "highlight": "Confirm the existing claim. Do not invent a new group or CCR.",
        "target": Scope("ccr", "ccr-2026-0019", "Existing operator-group claim for factory path", "prod"),
        "packet": """# HFACT-WP-0001-T03 — confirm CCR-2026-0019 operator-group

Blocking workplan: HFACT-WP-0001
Blocking task: HFACT-WP-0001-T03 (hub prefix 67c80db1, needs_human)

## Question
Confirm the existing operator-group claim for CCR-2026-0019 as required by the
factory identity, audit and approval path?

## One act
Confirm the already-named operator-group claim. Required-owner review and
attended apply remain separate acts.

## Must not
- Create a new CCR in this memo
- Collapse T03 with T05 live worker proof
""",
    },
    {
        "id": "infd-20260914-d03",
        "workplan": "MASON-WP-0005",
        "task": "Review the plan and obtain the decision",
        "hub_task_id": "48a2b4ec",
        "question": "Accept the fluid-telegram operator credential lane plan so construction may proceed?",
        "brief": (
            "MASON-WP-0005 has a review/decision task before building the operator lane. "
            "This memo is that plan accept. Path/OIDC binding (another task) is a separate memo if needed later."
        ),
        "highlight": "Accepting the plan is not confirming the OIDC binding and is not a BotFather login.",
        "target": Scope("workplan", "mason-wp-0005", "fluid-telegram operator credential lane plan", "prod"),
        "packet": """# MASON-WP-0005 — accept operator lane plan

Blocking workplan: MASON-WP-0005
Blocking task: Review the plan and obtain the decision (hub prefix 48a2b4ec)

## Question
Accept the fluid-telegram operator credential lane plan so construction may proceed?

## One act
Organizational accept of the written plan. BotFather login, DNS, and OIDC
binding remain other tasks.

## Must not
- Perform BotFather login in this sitting
- Record a telegram token
""",
    },
    {
        "id": "infd-20260914-d04",
        "workplan": "RCLK-WP-0002",
        "task": "RCLK-WP-0002-T01",
        "hub_task_id": "437734bd",
        "question": "Confirm ecosystem ownership and the security role for Railiance Clock as specified?",
        "brief": (
            "RCLK-WP-0002-T01 is the owner/security-role confirmation. This memo is that confirmation. "
            "It does not change OS clocks or admit railiance01 as production time authority by itself."
        ),
        "highlight": "Confirmation is ownership/role, not a clock change on any host.",
        "target": Scope("workplan", "rclk-wp-0002-t01", "Railiance Clock ownership and security role", "prod"),
        "packet": """# RCLK-WP-0002-T01 — confirm clock ownership

Blocking workplan: RCLK-WP-0002
Blocking task: RCLK-WP-0002-T01 (hub prefix 437734bd)

## Question
Confirm ecosystem ownership and the security role for Railiance Clock as specified?

## One act
Owner confirmation of the documented role split (railiance-infra for host UTC,
clock repo for specs). No NTP or OS change is authorized by this memo.

## Must not
- Change ntp.ubuntu.com or systemd-timesyncd from this sitting
- Treat this as RCLK-WP-0004 pilot admission
""",
    },
]


def write_batch(name: str, items: list[dict]) -> dict:
    directory = ROOT / name
    directory.mkdir(parents=True, exist_ok=True)
    index = {
        "kind": "informed-decision-batch",
        "id": f"infd-batch-2026-09-14-{name}",
        "review_group": REVIEW_GROUP,
        "status": "draft-unsigned",
        "submitted": False,
        "one_question_per_memo": True,
        "approve_all_forbidden": True,
        "agent_disposition_forbidden": True,
        "ordinal": [],
    }
    for i, item in enumerate(items, start=1):
        packet_path = directory / f"{item['id']}.packet.md"
        packet_path.write_text(item["packet"], encoding="utf-8")
        digest = _sha(item["packet"])
        memo = _memo(
            memo_id=item["id"],
            question=item["question"],
            brief=item["brief"],
            target=item["target"],
            packet_id=item["id"] + "-packet",
            packet_hash=digest,
            highlight=item["highlight"],
            workplan=item["workplan"],
            task=item["task"],
        )
        loaded = memo_from(__import__("json").loads(dumps(memo)))
        if loaded.question != item["question"]:
            raise RuntimeError("round-trip failed")
        memo_path = directory / f"{item['id']}.memo.json"
        memo_path.write_text(dumps(memo) + "\n", encoding="utf-8")
        index["ordinal"].append(
            {
                "n": i,
                "memo_id": item["id"],
                "workplan": item["workplan"],
                "task": item["task"],
                "hub_task_prefix": item["hub_task_id"],
                "question": item["question"],
                "memo": memo_path.name,
                "packet": packet_path.name,
                "packet_hash": digest,
                "required_highlight": f"{item['id']}-h1",
            }
        )
    (directory / "index.json").write_text(
        __import__("json").dumps(index, indent=2, ensure_ascii=False) + "\n",
        encoding="utf-8",
    )
    return index


def main() -> None:
    ROOT.mkdir(parents=True, exist_ok=True)
    cred = write_batch("credentials", CREDENTIALS)
    dec = write_batch("decisions", DECISIONS)
    sitting = {
        "kind": "informed-decision-sitting",
        "id": "infd-sitting-2026-09-14",
        "review_group": REVIEW_GROUP,
        "status": "draft-unsigned",
        "batches": [cred["id"], dec["id"]],
        "memo_count": len(cred["ordinal"]) + len(dec["ordinal"]),
        "bind_path": "INFD-WP-0001-T08 (not yet complete)",
        "note": "Unsigned drafts. Do not submit until CompactSignoffBatches.md is accepted. Live bind substitutes pending-human-session with the authenticated key-cape subject.",
    }
    (ROOT / "sitting.json").write_text(
        __import__("json").dumps(sitting, indent=2, ensure_ascii=False) + "\n",
        encoding="utf-8",
    )
    print(f"Wrote {sitting['memo_count']} unsigned memos under {ROOT}")


if __name__ == "__main__":
    main()