#!/usr/bin/env python3
"""Read-only launch preflight; outputs predicates only, never file contents."""
import configparser
import json
import os
from pathlib import Path
import pwd
import sys


def check_snapshot(s):
    checks = {
        'dedicated_guest': s['distro'] == 'custodian-codex',
        'account': s['uid'] == 1001 and s['gid'] == 1001,
        'private_home': s['home_mode'] == 0o700,
        'private_state': s['state_mode'] == 0o700,
        'home_owner': s['home_uid'] == 1001 and s['state_uid'] == 1001,
        'no_admin_groups': s['groups'] == [1001],
        'interop_config_disabled': s['interop'] == 'false',
        'automount_config_disabled': s['automount'] == 'false',
        'fstab_config_disabled': s['mount_fstab'] == 'false',
        'no_windows_mount': not s['windows_mount'],
        'no_operator_home': not s['operator_home'],
        'no_interop_handler': not s['interop_handler'],
    }
    return {'checks': checks, 'partial_preflight_passed': all(checks.values()),
            'assignment_admitted': False}


def main():
    try:
        c = configparser.ConfigParser(); c.read('/etc/wsl.conf')
        p = pwd.getpwnam('custodian-codex')
        home = Path(p.pw_dir).stat(); state = (Path(p.pw_dir)/'.codex').stat()
        result = check_snapshot({
            # systemd services do not necessarily inherit WSL_DISTRO_NAME.
            # Root-owned stage marker is partial local evidence, not host attestation.
            'distro': Path('/etc/cust73/distribution-name').read_text().strip(),
            'uid': p.pw_uid, 'gid': p.pw_gid,
            'home_mode': home.st_mode & 0o777, 'state_mode': state.st_mode & 0o777,
            'home_uid': home.st_uid, 'state_uid': state.st_uid,
            'groups': sorted(os.getgrouplist(p.pw_name, p.pw_gid)),
            'interop': c.get('interop','enabled'),
            'automount': c.get('automount','enabled'),
            'mount_fstab': c.get('automount','mountFsTab'),
            'windows_mount': Path('/mnt/c/Windows').exists(),
            'operator_home': Path('/home/worsch').exists(),
            'interop_handler': Path('/proc/sys/fs/binfmt_misc/WSLInterop').exists(),
        })
    except Exception:
        result = {'partial_preflight_passed': False, 'assignment_admitted': False,
                  'reason': 'preflight_refused'}
    print(json.dumps(result, sort_keys=True))
    return 0 if result['partial_preflight_passed'] else 1


if __name__ == '__main__':
    sys.exit(main())