#!/usr/bin/env python3
"""User-authorized empty KV seed for CCR-2026-0016; silent OIDC child."""
import json
from pathlib import Path
import subprocess
import sys

DATA_PATH = 'platform/data/workloads/glas-harness/claude-agent-dev'
META_PATH = 'platform/metadata/workloads/glas-harness/claude-agent-dev'
RECEIPT = Path('/tmp/glas-anthropic-empty-receipt.json')

def bao(*args, payload=None):
    r = subprocess.run(['bao', *args], input=None if payload is None else json.dumps(payload),
                       text=True, capture_output=True, timeout=30)
    if r.returncode:
        raise RuntimeError('bao_operation_failed')
    return json.loads(r.stdout) if r.stdout.strip() else {}

def main():
    if sys.argv[1:] == ['--verify-custody']:
        result = bao('read', '-format=json', META_PATH)
        observed = result['data']
        version = observed.get('current_version', 0)
        current = observed.get('versions', {}).get(str(version), {})
        if version < 2 or not current or current.get('destroyed') or current.get('deletion_time'):
            raise RuntimeError('no_live_successor_version')
        # Deliberately exclude arbitrary custom metadata and all data values.
        receipt = {'ccr': 'CCR-2026-0016', 'path': META_PATH,
                   'current_version': version, 'created_time': current.get('created_time'),
                   'live_successor_observed': True, 'secret_value_read': False,
                   'provider_authentication_verified': False,
                   'request_id': result.get('request_id')}
        Path('/tmp/glas-anthropic-custody-receipt.json').write_text(json.dumps(receipt))
        return
    if sys.argv[1:] == ['--complete-metadata']:
        receipt = json.loads(RECEIPT.read_text())
        if receipt.get('path') != DATA_PATH or receipt.get('version') != 1:
            raise RuntimeError('invalid_receipt')
        observed = bao('read', '-format=json', META_PATH)['data']
        if observed.get('current_version', 0) < 1:
            raise RuntimeError('missing_seed')
    elif not sys.argv[1:]:
        # CAS zero makes concurrent creation and existing versions refuse; no data GET.
        result = bao('write', '-format=json', DATA_PATH, '-',
                     payload={'options': {'cas': 0}, 'data': {'ANTHROPIC_API_KEY': ''}})
        version = result['data']['version']
        receipt = {'ccr': 'CCR-2026-0016', 'path': DATA_PATH, 'version': version,
                   'empty_seed_created': True, 'metadata_written': False,
                   'request_id': result.get('request_id')}
        with RECEIPT.open('x') as f:
            json.dump(receipt, f)
    else:
        raise RuntimeError('invalid_arguments')
    # Only non-secret custom metadata. No secret expiry is enforced by KV metadata.
    bao('write', '-format=json', META_PATH, '-', payload={'custom_metadata': {
        'ccr': 'CCR-2026-0016', 'custody_owner': 'railiance-platform',
        'provider': 'anthropic', 'organization_id': 'e1a8f305-9e64-4639-a7fd-af48e34f37c7',
        'provider_key_name': 'claude_key_bernd.worsch',
        'provider_expires_at': '2027-01-31T21:00:00Z',
        'seed_version': '1', 'seed_contains_secret': 'false',
        'handoff': 'operator creates next version in UI; runtime lane remains inactive'}})
    receipt['metadata_written'] = True
    RECEIPT.write_text(json.dumps(receipt))

if __name__ == '__main__':
    try:
        main()
    except Exception:
        sys.exit(1)  # contained executor must never return provider/client output