"""kings-guard's layer declaration is checkable, not merely asserted (§11).

The claim under test is the one our whole position rests on: no direct
Tooling-layer client. A test that only ran the checker against a clean tree
would prove nothing — it would pass just as happily if the checker were broken.
So the negative case is exercised too, on a synthetic tree.
"""
from __future__ import annotations

import subprocess
import sys
from pathlib import Path

import pytest

yaml = pytest.importorskip("yaml")

ROOT = Path(__file__).resolve().parents[1]
SCRIPT = ROOT / "scripts" / "check_layer_conformance.py"
DECL = ROOT / "layer.yaml"


def _run(*args: str) -> subprocess.CompletedProcess[str]:
    return subprocess.run(
        [sys.executable, str(SCRIPT), *args],
        capture_output=True,
        text=True,
    )


def test_declaration_exists_and_declares_staff():
    """§11: an estate-authored repository declares its layer machine-readably."""
    assert DECL.exists(), "no layer.yaml — §11 requires a machine-readable declaration"
    data = yaml.safe_load(DECL.read_text())
    assert data["repository"] == "kings-guard"
    assert data["layer"] == "staff"
    assert data["framework"] == "netkingdom-security-layer-model"


def test_no_tooling_contacts_declared():
    """The blocked-clean position: nothing to declare, because nothing is touched."""
    data = yaml.safe_load(DECL.read_text())
    assert data["tooling_contacts"] == [], (
        "a Tooling contact appeared in the declaration; kings-guard's blocked-clean "
        "position under §11 no longer holds and KG-DEC-2026-001 needs revisiting"
    )
    for shape, entries in data["declared_shapes"].items():
        assert entries == [], f"§5.{shape} shape declared; see comment above"


def test_unowned_capabilities_carry_the_gap_record_fields():
    """§5.3 field shape, reused for §13 unowned-capability rows (§17 gap-record)."""
    data = yaml.safe_load(DECL.read_text())
    caps = data["unowned_capabilities"]
    assert caps, "the three known gaps should be declared"
    for cap in caps:
        for field in ("capability", "intended_owner", "blocked_on", "review", "state"):
            assert cap.get(field), f"{cap.get('id')} missing '{field}'"
        assert cap["state"] == "unowned-capability"


def test_checker_passes_on_the_real_tree():
    result = _run()
    assert result.returncode == 0, result.stderr


def test_agent_principal_rule_checks_are_honest():
    """§3.4 claims that are tests, and claims that remain assertions, are named."""
    data = yaml.safe_load(DECL.read_text())
    checks = data["agent_principal_rule_checks"]
    assert checks["no_standing_credential"]["form"] == "test"
    assert checks["memory_is_not_a_state_plane"]["form"] == "test"
    assert checks["tool_use_shapes"]["form"] == "assertion"
    assert checks["reconstructable_as_caller"]["form"] == "mixed"
    assert data["agent_principal_rules"]["no_standing_credential"] is True


def test_checker_catches_a_standing_credential(tmp_path, monkeypatch):
    import importlib.util

    spec = importlib.util.spec_from_file_location("check_layer_conformance", SCRIPT)
    module = importlib.util.module_from_spec(spec)
    spec.loader.exec_module(module)

    fake_src = tmp_path / "src" / "kings_guard"
    fake_src.mkdir(parents=True)
    (fake_src / "secrets.py").write_text('VAULT_TOKEN = "s.standing-secret"\n')
    (tmp_path / ".env").write_text("OPENBAO_TOKEN=s.also-standing\n")
    monkeypatch.setattr(module, "SRC", fake_src)
    monkeypatch.setattr(module, "ROOT", tmp_path)

    hits = module.scan_standing_credentials()
    assert hits, "a standing credential was not detected — the checker is blind"
    kinds = " ".join(reason for _, reason in hits)
    assert "credential-shaped file" in kinds or "standing-credential" in kinds


def test_checker_catches_an_undeclared_tooling_client(tmp_path, monkeypatch):
    """The negative case: a direct OpenBao client must fail the check.

    This is the convenience §6 warns about — it would arrive as one import.
    """
    import importlib.util

    spec = importlib.util.spec_from_file_location("check_layer_conformance", SCRIPT)
    module = importlib.util.module_from_spec(spec)
    spec.loader.exec_module(module)

    fake_src = tmp_path / "src" / "kings_guard"
    fake_src.mkdir(parents=True)
    (fake_src / "effector.py").write_text(
        "import hvac\n\n\ndef contain(actor):\n    hvac.Client().revoke(actor)\n"
    )
    monkeypatch.setattr(module, "SRC", fake_src)
    monkeypatch.setattr(module, "ROOT", tmp_path)

    hits = module.scan()
    assert hits, "a direct OpenBao client was not detected — the checker is blind"
    assert hits[0][1] == "hvac"