"""Supervised receipt bookkeeping, not an authenticated approval provider."""
import datetime
import fcntl
import hashlib
import json
import os
import re
from pathlib import Path
import stat
import uuid

FOUNDER = {'kind': 'person', 'sub': 'uid=platform-root,ou=people,dc=netkingdom,dc=local'}
MEMO_ID = 'infd-20261011-zlib-remediation-r1'
PROPOSAL = 'INFD-WP-0009-T05/zlib85091-r1'
PHASES = ('drill-backup', 'drill-copy', 'offline-verify', 'cleanup-offline',
          'cutover-backup', 'cutover-copy', 'release', 'verify', 'rollback', 'rollback-verify')


def require(value, reason):
    if not value:
        raise ValueError(reason)


def sha(path):
    digest = hashlib.sha256()
    with Path(path).open('rb') as stream:
        for block in iter(lambda: stream.read(1024**2), b''):
            digest.update(block)
    return digest.hexdigest()


def private(path, directory=False):
    info = Path(path).lstat()
    require((stat.S_ISDIR(info.st_mode) if directory else stat.S_ISREG(info.st_mode))
            and info.st_uid == os.getuid() and stat.S_IMODE(info.st_mode) == (0o700 if directory else 0o600)
            and (directory or info.st_nlink == 1), 'private owned custody required')


def authority(receipt, outcome, memo_sha, source_revision, phase, now=None):
    """Root must freshly verify native outcome at fixed ORIGIN outside this helper.

    Receipt files/flags are not signed grants. This function checks the exact
    supervised receipt relation; existing harness/founder authority remains the
    actual permission boundary. It never authenticates a caller as human.
    """
    now = now or datetime.datetime.now(datetime.timezone.utc)
    require(phase in PHASES, 'fixed phase required')
    require(receipt.get('proposal_id') == PROPOSAL and receipt.get('memo_id') == MEMO_ID
            and receipt.get('memo_version') == 1 and receipt.get('memo_sha256') == memo_sha
            and receipt.get('source_revision') == source_revision
            and receipt.get('activation') == 'APPROVED'
            and receipt.get('authority_mode') == 'ADMINISTER'
            and receipt.get('target') == 'realm:kubernetes/railiance01/informed-decision'
            and receipt.get('verification_method') == 'root-fixed-origin-native-readback'
            and receipt.get('runtime_authenticated_grant') is False
            and receipt.get('outcome_query') == '/lifecycle/memos/' + MEMO_ID + '/outcomes?version=1',
            'exact externally verified supervised receipt required')
    verified = datetime.datetime.fromisoformat(receipt['verified_at'].replace('Z', '+00:00'))
    require(verified.tzinfo is not None and 0 <= (now - verified).total_seconds() <= 120,
            'fresh root native readback required before every phase')
    deadline = datetime.datetime.fromisoformat('2026-10-12T23:59:59+00:00')
    require(now < deadline, 'approved execution window expired')
    if phase == 'release':
        require((deadline-now).total_seconds() >= 1800, 'reserve thirty minutes for verification and recovery')
    require(outcome.get('memo_id') == MEMO_ID and outcome.get('review', {}).get('stale') is False
            and outcome['review'].get('intake_state') == 'ready', 'native review is not ready/current')
    review_id = outcome['review']['memo_id']
    require(review_id == receipt.get('review_memo_id'), 'native review identity changed')
    accepted = [x for x in outcome.get('dispositions', [])
                if x.get('submission_state') == 'confirmed'
                and x.get('disposition', {}).get('verb') == 'accept'
                and x['disposition'].get('memo_version') == 1]
    require(len(accepted) == 1, 'one confirmed founder acceptance required')
    accepted = accepted[0]['disposition']
    require(accepted.get('actor') == FOUNDER and accepted.get('memo_id') == review_id
            and accepted.get('approval_id') == receipt.get('approval_id')
            and accepted.get('id') == receipt.get('disposition_id')
            and accepted.get('at') == receipt.get('accepted_at'), 'exact founder disposition mismatch')
    require(re.fullmatch(r'[a-f0-9-]{36}', accepted['approval_id']) is not None
            and re.fullmatch(r'disp-[a-f0-9-]{36}', accepted['id']) is not None
            and re.fullmatch(r'review-[a-f0-9-]{36}', review_id) is not None,
            'native disposition identifiers are malformed')
    accepted_at = datetime.datetime.fromisoformat(accepted['at'].replace('Z', '+00:00'))
    require(accepted_at.tzinfo is not None and accepted_at <= verified, 'acceptance time not bounded')
    return {key: receipt[key] for key in ('approval_id', 'disposition_id', 'accepted_at', 'verified_at')}


def fresh_scan(receipt, report, contract, now=None):
    """Root supervised scan bookkeeping; actual scanner proof stays retained."""
    now=now or datetime.datetime.now(datetime.timezone.utc)
    require(receipt.get('image')=='forgejo.coulomb.social/coulomb/informed-decision@sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23'
            and receipt.get('artifact_source_revision')=='9b4bb25d325698ae543e7e8a8a3c3592db1f58fc'
            and receipt.get('scanner')=='aquasec/trivy@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969'
            and receipt.get('no_suppression') is True and receipt.get('full_allseverity_scan') is True
            and receipt.get('exit_code')==0,'exact full immutable artifact scan required')
    scanned=datetime.datetime.fromisoformat(receipt['completed_at'].replace('Z','+00:00'))
    metadata=receipt['db_metadata'];updated=datetime.datetime.fromisoformat(metadata['UpdatedAt'].replace('Z','+00:00'));next_update=datetime.datetime.fromisoformat(metadata['NextUpdate'].replace('Z','+00:00'))
    require(all(t.tzinfo is not None for t in (scanned,updated,next_update))
            and updated<=scanned<=now<next_update and (now-scanned).total_seconds()<=14400
            and metadata.get('Version')==2 and re.fullmatch(r'[a-f0-9]{64}',receipt.get('db_sha256','')) is not None,'scan or vulnerability database expired')
    require(isinstance(report,dict) and isinstance(report.get('Results'),list) and report['Results'],'retained full scan results required')
    require(report.get('SchemaVersion')==2 and report.get('ArtifactType')=='container_image','full immutable container scan schema required')
    metadata_report=report.get('Metadata',{});config=metadata_report.get('ImageConfig',{})
    require(metadata_report.get('ImageID')==contract['image_config_id'] and metadata_report.get('DiffIDs')==contract['diff_ids']
            and config.get('rootfs')==contract['image_config_rootfs'] and config.get('config',{}).get('Labels')==contract['image_source_labels']
            and metadata_report.get('OS')==contract['os'],'scan image config layers or source labels differ')
    classes=[(x.get('Class'),x.get('Type')) for x in report['Results']]
    require(sorted(classes)==[('lang-pkgs','python-pkg'),('os-pkgs','alpine')],'exact OS and Python scan coverage required')
    inventory=[]
    for result in report['Results']:
        packages=result.get('Packages');expected_count=38 if result['Class']=='os-pkgs' else 6
        require(isinstance(packages,list) and len(packages)==expected_count,'full package inventory coverage required')
        for package in packages:
            require(isinstance(package,dict) and isinstance(package.get('Name'),str) and isinstance(package.get('Version'),str)
                    and isinstance(package.get('Identifier',{}).get('PURL'),str),'package identity absent')
            inventory.append([result['Class'],result['Type'],package['Name'],package['Version'],package['Identifier']['PURL']])
    inventory.sort();require(len({tuple(p) for p in inventory})==44 and inventory==contract['inventory']
                            and hashlib.sha256(json.dumps(inventory,sort_keys=True,separators=(',',':')).encode()).hexdigest()==contract['inventory_canonical_sha256'],'immutable inventory differs from published 38 OS and 6 Python packages')
    require(any(p[0]=='os-pkgs' and p[2]=='zlib' and p[3]=='1.3.2-r1' for p in inventory),'fixed zlib package missing')
    for result in report['Results']:
        require(isinstance(result,dict) and isinstance(result.get('Vulnerabilities',[]),(list,type(None))),'full scan result invalid')
        require(not result.get('Vulnerabilities'),'new finding refuses release and closure')
    return {'full_report_sha256':receipt['full_report_sha256'],'db_sha256':receipt['db_sha256'],'completed_at':receipt['completed_at'],'next_update':metadata['NextUpdate'],'allseverity_findings':0}


def recovery_authority(receipt, cache, journal, memo_sha, revision, sealed, dependencies, phase, now=None):
    """Explicit new human term: supervised bounded service-outage recovery.

    Cached acceptance is historical evidence, not a current revocation read or
    autonomous/signed grant. Root's fresh outage evidence never fabricates
    current outcomes. Only this trial's disclosed image/source recovery applies.
    """
    now=now or datetime.datetime.now(datetime.timezone.utc)
    require(phase in ('rollback','rollback-verify'),'outage fallback is recovery-only')
    release=journal.get('phases',{}).get('release');require(isinstance(release,dict) and release.get('state') in ('RUNNING','UNCERTAIN','COMPLETE'),'recorded actual release attempt required')
    started=datetime.datetime.fromisoformat(release['started_at']);deadline=datetime.datetime.fromisoformat('2026-10-12T23:59:59+00:00')
    require(started.tzinfo is not None and 0<=(now-started).total_seconds()<=1800 and now<deadline,'bounded recovery window expired')
    require(receipt.get('kind')=='informed-decision.root-supervised-outage-recovery'
            and receipt.get('proposal_id')==PROPOSAL and receipt.get('source_revision')==revision and receipt.get('memo_sha256')==memo_sha
            and receipt.get('phase')==phase and receipt.get('release_attempt_id')==release['attempt_id']
            and receipt.get('cache_sha256')==release.get('release_authority_cache_sha256')
            and receipt.get('root_verified') is True and receipt.get('manual_supervised_recovery') is True
            and receipt.get('current_native_outcomes_claimed') is False,'exact supervised bounded recovery receipt required')
    observed=datetime.datetime.fromisoformat(receipt['observed_at'].replace('Z','+00:00'))
    require(observed.tzinfo is not None and 0<=(now-observed).total_seconds()<=120,'fresh outage observation required')
    require((receipt.get('native_probe_status')=='transport-unavailable' or type(receipt.get('native_probe_status')) is int and receipt['native_probe_status'] in (502,503,504))
            and receipt.get('explicit_revoked') is False and receipt.get('current_conflict') is False
            and receipt.get('identity_or_scope_mismatch') is False and receipt.get('service_healthy') is False,'outage recovery refuses denial/revocation/conflict/healthy service')
    require(receipt.get('deployment_uid')==sealed['metadata']['uid'] and receipt.get('configmap_uid')==dependencies['configmap']['metadata']['uid']
            and receipt.get('pvc_uid')==dependencies['pvc']['metadata']['uid']
            and receipt.get('rollback_image')=='forgejo.coulomb.social/coulomb/informed-decision@sha256:763c36402c8be7cc4c1bd1a61623d1aff9116d52241877425b45a7018cc0883a'
            and receipt.get('rollback_source')=='c96b0c6d881e855d1d158003c6de90ef390262e2','exact same-trial recovery custody required')
    previous=cache['root_authority'];require(previous.get('bounded_outage_rollback_pre_authorized') is True,'new human packet must expressly preauthorize outage recovery')
    verified=datetime.datetime.fromisoformat(previous['verified_at'].replace('Z','+00:00'))
    require(verified.tzinfo is not None and 0<=(started-verified).total_seconds()<=120,'cached root acceptance must precede actual release freshly')
    require(cache.get('memo_sha256')==memo_sha and cache.get('source_revision')==revision
            and cache.get('plan_sha256')==journal['identity']['plan_sha256'],'cache trial/source/plan differs')
    historical=authority(previous,cache['native_outcome'],memo_sha,revision,'release',verified)
    if phase=='rollback':
        placement=receipt.get('failed_candidate');require(isinstance(placement,dict) and placement.get('image')=='forgejo.coulomb.social/coulomb/informed-decision@sha256:f5588f496b1f267d07cdc9f5208e6f2f241f74b739c23924b03702dec13a5c23'
            and placement.get('application_source')==revision and type(placement.get('ready_replicas')) is int and placement['ready_replicas']==0,'failed candidate placement required before recovery')
    else:
        rollback=journal['phases'].get('rollback');require(isinstance(rollback,dict) and rollback.get('state')=='COMPLETE'
            and rollback.get('outage_recovery_receipt_sha256')==receipt.get('original_outage_receipt_sha256')
            and isinstance(rollback.get('outage_recovery_anchor'),dict),'same-journal completed rollback and prior outage witness required')
        require(receipt.get('recovered_image')==receipt['rollback_image'] and receipt.get('recovered_application_source')==receipt['rollback_source']
                and type(receipt.get('ready_replicas')) is int and receipt['ready_replicas']==1,'separate exact recovered placement required')
    return {**historical,'bounded_outage_recovery':True,'current_revocation_verified':False}


class Journal:
    def __init__(self, parent, identity):
        self.parent = Path(parent)
        private(self.parent, directory=True)
        self.path = self.parent / 'execution-journal.json'
        self.lock = os.open(self.parent / 'execution.lock', os.O_CREAT | os.O_NOFOLLOW | os.O_RDWR, 0o600)
        fcntl.flock(self.lock, fcntl.LOCK_EX | fcntl.LOCK_NB)
        private(self.parent / 'execution.lock')
        if self.path.exists():
            private(self.path)
            self.data = json.loads(self.path.read_text())
            require(self.data['identity'] == identity, 'journal case/source identity changed')
        else:
            self.data = {'identity': identity, 'phases': {}}
            self.save()

    def save(self):
        temporary = self.parent / 'execution-journal.new'
        fd = os.open(temporary, os.O_CREAT | os.O_EXCL | os.O_NOFOLLOW | os.O_WRONLY, 0o600)
        try:
            with os.fdopen(fd, 'w') as stream:
                json.dump(self.data, stream, indent=2)
                stream.write('\n')
                stream.flush()
                os.fsync(stream.fileno())
            os.replace(temporary, self.path)
            directory = os.open(self.parent, os.O_DIRECTORY | os.O_RDONLY)
            try:
                os.fsync(directory)
            finally:
                os.close(directory)
        except BaseException:
            # Retain evidence rather than overwriting an uncertain durable intent.
            raise

    def start(self, phase, approval):
        require(phase not in self.data['phases'], 'already attempted phase; no retry')
        predecessors = dict(zip(PHASES[1:8], PHASES[:7]))
        predecessors['rollback-verify'] = 'rollback'
        if phase in predecessors:
            require(self.data['phases'].get(predecessors[phase], {}).get('state') == 'COMPLETE',
                    'preceding phase is not verified complete')
        if phase == 'rollback':
            require('release' in self.data['phases'], 'rollback requires a recorded release attempt')
        self.data['phases'][phase] = {'state': 'RUNNING', 'approval': approval,
                                      'attempt_id': str(uuid.uuid4()),
                                      'started_at': datetime.datetime.now(datetime.timezone.utc).isoformat()}
        self.save()

    def note(self, phase, key, value):
        require(self.data['phases'][phase]['state'] == 'RUNNING', 'phase intent missing')
        self.data['phases'][phase][key] = value
        self.save()

    def finish(self, phase, result):
        entry = self.data['phases'][phase]
        require(entry['state'] == 'RUNNING', 'phase intent missing')
        entry['result'] = result
        entry['state'] = 'COMPLETE' if result.get('all_checks_pass') is True else 'UNCERTAIN'
        self.save()

    def close(self):
        os.close(self.lock)