"""Integrate three exact reviewed source patches. No commit, deploy or admission."""
from datetime import datetime, timezone
import hashlib
import json
from pathlib import Path
import subprocess

ROOT = Path(__file__).resolve().parent
TARGETS = (
    ("glas-harness", "agent-isolation", "glas-harness.patch",
     "83eeeb0017603aabae0ff49a23f96248f677f6c9f3e2c01b22f6d0416fca69c7",
     "dc88f302044c7c2b41795958527e64be8a83e3ab"),
    ("railiance-platform", "protected-execution-wave2", "platform-native-fixture.patch",
     "c419ac0f6dba3e36f15dc51a6a36fbd87fe7d255cce40c33c7f4589d80355580",
     "69a792c070238273acd9a989e2707072a5ef55ed"),
    ("secrets-engine", "decision-auth", "implementation-r2.patch",
     "98c4300c42fe93759a55297fe6629f1d4aeed249c3625f7fd37c8ab523a08ca9",
     "6bd7129eac94131b4cf689e47cbdc9899418beb3"),
)


def main():
    prepared = []
    for repo, part, patch_name, expected_patch, expected_head in TARGETS:
        owner, folder = Path("/home/worsch") / repo, ROOT / part
        patch = folder / patch_name
        assert hashlib.sha256(patch.read_bytes()).hexdigest() == expected_patch, repo
        head = subprocess.check_output(["git", "rev-parse", "HEAD"], cwd=owner, text=True).strip()
        assert head == expected_head, f"owner revision changed: {repo}"
        if repo == "glas-harness":
            manifest = json.loads((folder / "source-manifest.json").read_text())
            files = {item["path"]: item["candidate_sha256"] for item in manifest["changes"]}
        elif repo == "railiance-platform":
            files = json.loads((folder / "manifest.json").read_text())["files_sha256"]
        else:
            files = json.loads((folder / "reviewed-r2-file-hashes.json").read_text())
        assert not subprocess.check_output(["git", "diff", "HEAD", "--", *files], cwd=owner), f"target files dirty: {repo}"
        for name in files:
            tracked = subprocess.run(["git", "ls-files", "--error-unmatch", name], cwd=owner, capture_output=True).returncode == 0
            assert tracked or not (owner / name).exists(), f"untracked target collision: {repo}/{name}"
        subprocess.run(["git", "apply", "--check", str(patch)], cwd=owner, check=True)
        prepared.append((repo, owner, folder, patch, expected_patch, head, files))
    for repo, owner, folder, patch, patch_hash, head, files in prepared:
        subprocess.run(["git", "apply", str(patch)], cwd=owner, check=True)
        for name, expected in files.items():
            assert hashlib.sha256((owner / name).read_bytes()).hexdigest() == expected, f"integrated file differs: {repo}/{name}"
        receipt = {"repo": repo, "base_commit": head, "patch_sha256": patch_hash,
                   "integrated_at": datetime.now(timezone.utc).isoformat(), "files_sha256": files,
                   "source_integrated": True, "committed": False, "published": False,
                   "native_accepted": False}
        (folder / "canonical-integration.json").write_text(json.dumps(receipt, indent=2) + "\n")
        print(f"{repo}: {len(files)} exact reviewed source files integrated")


if __name__ == "__main__":
    main()