"""Seed data: statute §13 snapshot, §13.1 stance inventory, first two ladders.

Ladder *content* is not authored here. ASM-0…ASM-6 is gate-house's
(Active Secrets Management Canon v0.3 §38). PEP-stance publication is
ops-warden's (ADR-0009). This module registers those ladders as data.
"""

from __future__ import annotations

from maturity_engine.models import Criterion, Gap, Ladder, Level, StanceMap

REVIEW = "2026-11-28"


def _c(criterion_id: str, kind: str, description: str) -> Criterion:
    return Criterion(id=criterion_id, evidence_kind=kind, description=description)


def asm_ladder() -> Ladder:
    """ASM-0…ASM-6. Criteria kinds are mechanical; doctrine stays gate-house's."""
    levels = (
        Level(0, "ASM-0", "Embedded", ()),
        Level(
            1,
            "ASM-1",
            "Stored",
            (
                _c("asm-1-manager", "central-secret-manager", "Central secret manager exists"),
                _c("asm-1-rbac", "secret-rbac", "RBAC on secrets exists"),
                _c("asm-1-scan", "basic-secret-scanning", "Basic secret scanning exists"),
                _c("asm-1-rotate", "basic-rotation", "Basic rotation exists"),
            ),
        ),
        Level(
            2,
            "ASM-2",
            "Managed",
            (
                _c("asm-2-owner", "secret-ownership", "Ownership is established"),
                _c("asm-2-auto", "automated-rotation", "Automated rotation is established"),
                _c("asm-2-inv", "secret-inventory", "Inventory is established"),
                _c("asm-2-detect", "exposure-detection", "Detection is established"),
                _c("asm-2-remediate", "measurable-remediation", "Measurable remediation is established"),
            ),
        ),
        Level(
            3,
            "ASM-3",
            "Dynamic",
            (
                _c("asm-3-fed", "workload-federation", "Workload federation reduces standing credentials"),
                _c("asm-3-jit", "jit-access", "JIT access reduces standing credentials"),
                _c("asm-3-dyn", "dynamic-secrets", "Dynamic secrets reduce standing credentials"),
                _c("asm-3-ci", "secretless-cicd", "Secretless CI/CD reduces standing credentials"),
            ),
        ),
        Level(
            4,
            "ASM-4",
            "Agent-Aware",
            (
                _c("asm-4-split", "principal-actor-distinction", "Human principal and agent actor are distinguished"),
                _c("asm-4-asst", "assistant-mode-modeled", "Assistant mode is explicitly modeled"),
                _c("asm-4-auto", "autonomous-mode-modeled", "Autonomous mode is explicitly modeled"),
            ),
        ),
        Level(
            5,
            "ASM-5",
            "Governed Autonomy",
            (
                _c("asm-5-id", "agent-identities", "Autonomous agents have identities"),
                _c("asm-5-man", "agent-mandates", "Autonomous agents have mandates"),
                _c("asm-5-budget", "agent-budgets", "Autonomous agents have budgets"),
                _c("asm-5-ceil", "authority-ceilings", "Authority ceilings are in force"),
                _c("asm-5-env", "change-envelopes", "Change envelopes are in force"),
                _c("asm-5-cb", "circuit-breakers", "Deterministic circuit breakers are in force"),
            ),
        ),
        Level(
            6,
            "ASM-6",
            "Closed-Loop Authority",
            (
                _c("asm-6-id", "identity-join", "Identity is in the reconciled authority lifecycle"),
                _c("asm-6-del", "delegation-join", "Delegation is in the reconciled authority lifecycle"),
                _c("asm-6-iss", "issuance-join", "Credential issuance is in the reconciled authority lifecycle"),
                _c("asm-6-exec", "execution-join", "Execution is in the reconciled authority lifecycle"),
                _c("asm-6-ev", "evidence-join", "Evidence is in the reconciled authority lifecycle"),
                _c("asm-6-exp", "exposure-join", "Exposure detection is in the reconciled authority lifecycle"),
                _c("asm-6-rev", "revocation-join", "Revocation is in the reconciled authority lifecycle"),
                _c("asm-6-rem", "remediation-join", "Remediation is in the reconciled authority lifecycle"),
            ),
        ),
    )
    return Ladder(
        id="asm",
        version="0.3",
        owner="gate-house",
        name="Active Secrets Management",
        levels=levels,
    )


def pep_stance_publication_ladder() -> Ladder:
    """Publication of unreachable-engine stance maps. Doctrine is ops-warden's."""
    levels = (
        Level(0, "PSP-0", "Unpublished", ()),
        Level(
            1,
            "PSP-1",
            "Published",
            (_c("psp-1-file", "stance-map-published", "Stance map published at a named path"),),
        ),
        Level(
            2,
            "PSP-2",
            "Tested",
            (
                _c(
                    "psp-2-test",
                    "stance-map-equality-test",
                    "A test asserts the published map equals shipped behaviour",
                ),
            ),
        ),
    )
    return Ladder(
        id="pep-stance-publication",
        version="0.1",
        owner="ops-warden",
        name="PEP stance-map publication",
        levels=levels,
    )


def section_13_gaps() -> tuple[Gap, ...]:
    """Statute §13 snapshot. state and owner_status survive the migration."""
    return (
        Gap(
            id="ssh-ca-signing-write",
            capability="SSH-CA signing write (VaultCA, bao kv put)",
            intended_owner="secrets-engine",
            blocked_on="No engine exposes an SSH certificate signing surface",
            review=REVIEW,
            state="declared-contact",
            owner_status="proposed",
            declared_by="ops-warden",
            mark="declared-gap",
        ),
        Gap(
            id="authentication-assurance-evidence",
            capability="Authentication / assurance evidence",
            intended_owner="identity layer + audit-core",
            blocked_on="access-engine declined (FLEX-DEC-2026-002); no identity-layer evidence surface",
            review=REVIEW,
            state="unowned-capability",
            owner_status="declined",
            declared_by="kings-guard",
            mark="pending",
            notes="access-engine declined; reproposed, not assented",
        ),
        Gap(
            id="secret-use-evidence",
            capability="Secret-use evidence",
            intended_owner="secrets-engine",
            blocked_on="No engine exposes secret-use evidence; OpenBao is Tooling",
            review=REVIEW,
            state="unowned-capability",
            owner_status="proposed",
            declared_by="kings-guard",
            mark="pending",
        ),
        Gap(
            id="actuation-containment-surface",
            capability="Reduce authority, require step-up, isolate a workload — as a deterministic engine API",
            intended_owner="access-engine + runtime PEPs",
            blocked_on="Ruled in v0.7 §9.2 to be an Engine concept, unowned and held at zero",
            review=REVIEW,
            state="unowned-capability",
            owner_status="proposed",
            declared_by="gate-house (estate-wide)",
            mark="pending",
            notes="kings-guard proposes containment and does not own it",
        ),
        Gap(
            id="identity-and-secret-observation",
            capability="Identity and secret observation",
            intended_owner="identity layer + secrets-engine + audit-core",
            blocked_on="No engine exposes the observation surface; kings-guard makes no Tooling contact",
            review=REVIEW,
            state="unowned-capability",
            owner_status="proposed",
            declared_by="kings-guard",
            mark="pending",
        ),
        Gap(
            id="stance-map-register",
            capability="Stance-map register had no implementation",
            intended_owner="gate-house",
            blocked_on=None,
            review=REVIEW,
            state="resolved",
            owner_status="resolved",
            declared_by="ops-warden, access-engine",
            mark=None,
            notes="resolved in statute §13.1; inventory now held here",
        ),
        Gap(
            id="registry-snapshot-digest",
            capability="Registry-snapshot digest in decision provenance",
            intended_owner="flex-auth",
            blocked_on="Decision provenance holds no snapshot digest; a registry compile of a level would be unfalsifiable",
            review=REVIEW,
            state="declared-contact",
            owner_status="self-declared",
            declared_by="flex-auth",
            mark="declared-gap",
        ),
        Gap(
            id="approval-storage-lifecycle",
            capability="Approval storage and lifecycle",
            intended_owner="approval-engine",
            blocked_on=None,
            review=REVIEW,
            state="assigned",
            owner_status="assigned",
            declared_by="flex-auth",
            mark=None,
            notes="assigned (§9.4)",
        ),
        Gap(
            id="approval-evidence",
            capability="Approval evidence",
            intended_owner="audit-core",
            blocked_on=None,
            review=REVIEW,
            state="assigned",
            owner_status="assented",
            declared_by="gate-house",
            mark=None,
            notes="assented (AUDIT-IN-0001)",
        ),
        Gap(
            id="approval-evidence-custody-stronger",
            capability="Approval evidence custody stronger than the shipped bound — WORM, object lock, transparency log",
            intended_owner=None,
            blocked_on="Doctrine work not yet done; approval evidence carries the same bound as every other source",
            review=REVIEW,
            state="unowned-capability",
            owner_status="unassigned",
            declared_by="audit-core",
            mark="pending",
        ),
        Gap(
            id="approval-emission-atomicity",
            capability="Emission atomicity for approval state changes",
            intended_owner="approval-engine",
            blocked_on=None,
            review=REVIEW,
            state="assigned",
            owner_status="assigned",
            declared_by="audit-core",
            mark=None,
            notes="assigned (§9.4)",
        ),
        Gap(
            id="ssh-signing-non-atomic-audit",
            capability="Non-atomic audit emission on the SSH signing lane",
            intended_owner="ops-warden",
            blocked_on="Declared trade so an audit-store failure cannot remove production host access",
            review=REVIEW,
            state="declared-contact",
            owner_status="self-declared",
            declared_by="ops-warden",
            mark="declared-gap",
            notes="attributive (§9.6)",
        ),
    )


def section_13_1_stances() -> tuple[StanceMap, ...]:
    return (
        StanceMap(
            consumer="ops-warden",
            published=True,
            path="ops-warden/pep-stance.yaml",
            shape=(
                "total per-zone; open z0–z2 and unknown, closed z3-critical; "
                "test asserts the published map equals the shipped default (ADR-0009)"
            ),
        ),
        StanceMap(
            consumer="ops-mason",
            published=False,
            path=None,
            shape="catalogued PEP-shaped in §4; map not published",
        ),
    )