"""ready.py against the owners' real source (NK-WP-0058-T02): the sibling checkouts locally, the fetched owners in CI.

Rows E5, C1, C2, C6 and C7 of docs/bounded-execution-contract-table.md. rapp-bounded-executor is private, so its
pilot config is replaced by the values the admission and NK-WP-0056 expect; everything else is owner source.
"""
import importlib.util
import json
from pathlib import Path

import pytest
import yaml

REPO = Path(__file__).resolve().parents[3]
SIBLINGS = REPO.parent
spec = importlib.util.spec_from_file_location('ready_owner', REPO / 'tools/bounded-execution-readiness/ready.py')
ready = importlib.util.module_from_spec(spec)
spec.loader.exec_module(ready)

OWNERS = ('railiance-platform', 'informed-decision', 'access-engine')
ADMISSION = REPO / 'admissions/BEA-2026-0003.yaml'
INSIDE = ready.when('2026-11-05T08:25:00Z')
PILOT = {'executor_identity': 'service:nk-bind-executor',
         'runtime_principal': 'system:serviceaccount:sso:nk-bind-executor',
         'approver_subjects': {'admin': 'uid=admin,ou=people,dc=netkingdom,dc=local'}}
# informed-decision revisions on 2026-11-04 (first pilot attempt): Argo pinned 312ab97e, which predates the
# executor's registration; live ran the founder-run release 005709a, which routed net-kingdom-admins to platform-root.
ARGO_PIN_2026_11_04, LIVE_2026_11_04 = '312ab97e', '005709a'

pytestmark = pytest.mark.skipif(not all((SIBLINGS / o / '.git').exists() for o in OWNERS),
                                reason='owner checkouts required (CI: tools/contract-tests/fetch_owners.py)')


def layout(tmp_path, argo_revision=None):
    root = tmp_path / 'siblings'
    root.mkdir()
    for owner in ('informed-decision', 'access-engine'):
        (root / owner).symlink_to(SIBLINGS / owner)
    platform = root / 'railiance-platform'
    platform.mkdir()
    for part in ('scripts', 'credential-change-requests'):
        (platform / part).symlink_to(SIBLINGS / 'railiance-platform' / part)
    app = yaml.safe_load((SIBLINGS / 'railiance-platform' / ready.ARGO_APP).read_text())
    if argo_revision:
        app['spec']['source']['targetRevision'] = argo_revision
    (platform / ready.ARGO_APP).parent.mkdir(parents=True)
    (platform / ready.ARGO_APP).write_text(yaml.safe_dump(app))
    config = root / 'rapp-bounded-executor' / ready.RAPP_CONFIG
    config.parent.mkdir(parents=True)
    config.write_text(json.dumps(PILOT))
    return root


def test_owner_sources_hold_the_bounded_execution_contracts(tmp_path):
    r = ready.run(ADMISSION, 'apr-1', layout(tmp_path), INSIDE)
    assert r['agent_checks_pass'], r['failures']


@pytest.mark.parametrize('revision, failure', [
    (ARGO_PIN_2026_11_04, 'executor_registered:pinned'),   # an Argo sync would have dropped the registration
    (LIVE_2026_11_04, 'recipient_is_approver:pinned'),     # live routed the memo to platform-root
])
def test_replay_2026_11_04_from_owner_history(tmp_path, revision, failure):
    r = ready.run(ADMISSION, 'apr-1', layout(tmp_path, argo_revision=revision), INSIDE)
    assert failure in r['failures']