#!/usr/bin/env python3
"""Verification-only orchestration. Fresh exact revision-3 founder approval required."""
import argparse
from datetime import datetime, timezone
import hashlib
import json
import os
from pathlib import Path
import shlex
import subprocess
import sys

HERE=Path(__file__).resolve().parent
DIGEST='f59959b605a51abd2901becde14e7abd852c2bd3f848004b51d250d1cb81af6d'
STAGE='/home/tegwick/.helixforge-factory/runtime-verify-f599-r3-20261017'
STORE='/home/tegwick/.helixforge-factory/runtimes'
DURABLE_RECEIPT=STAGE+'.receipt.json'

READ_TARGET=r'''import json,os,pwd,stat,subprocess,shutil,time,ctypes,gzip,sys
from pathlib import Path
store=Path('/home/tegwick/.helixforge-factory/runtimes'); stage=Path('/home/tegwick/.helixforge-factory/runtime-verify-f599-r3-20261017');digest='f59959b605a51abd2901becde14e7abd852c2bd3f848004b51d250d1cb81af6d'
def meta(p):
 try:
  s=p.lstat();return {'uid':s.st_uid,'gid':s.st_gid,'mode':oct(stat.S_IMODE(s.st_mode)),'device':s.st_dev,'inode':s.st_ino,'directory':stat.S_ISDIR(s.st_mode),'symlink':stat.S_ISLNK(s.st_mode)}
 except FileNotFoundError:return None
cp=subprocess.run(['/usr/local/bin/kubectl','get','nodes','-o','json'],capture_output=True,timeout=20)
assert cp.returncode==0
nodes=json.loads(cp.stdout)['items'];assert len(nodes)==1
mem=dict(x.split(':',1) for x in Path('/proc/meminfo').read_text().splitlines())
read_cpu=lambda:[int(x) for x in Path('/proc/stat').read_text().splitlines()[0].split()[1:9]]
a=read_cpu();time.sleep(1);b=read_cpu();d=[y-x for x,y in zip(a,b)];busy=1-(d[3]+d[4])/sum(d)
help_result=subprocess.run(['/usr/bin/bwrap','--help'],stdout=subprocess.PIPE,stderr=subprocess.DEVNULL,timeout=10)
version=subprocess.run(['/usr/bin/bwrap','--version'],stdout=subprocess.PIPE,stderr=subprocess.DEVNULL,timeout=10)
manual=gzip.decompress(Path('/usr/share/man/man1/bwrap.1.gz').read_bytes()).decode();i=manual.find('die\\-with\\-parent')
fd=os.pidfd_open(os.getpid());os.close(fd);value=ctypes.c_int();subreaper_get=ctypes.CDLL(None).prctl(37,ctypes.byref(value),0,0,0)
reader={};exec(compile(sys.argv[1],'reviewed_public_digest_reader','exec'),reader)
native_digest=reader['runtime_digest'](store/digest)
print(json.dumps({'installed_complete_digest':native_digest,'durable_receipt':meta(Path(str(stage)+'.receipt.json')),'bwrap_version':version.stdout.decode().strip(),'bwrap_die_with_parent_supported':help_result.returncode==0 and b'--die-with-parent' in help_result.stdout,'primary_manual_contract_excerpt':manual[max(0,i-20):i+430] if i>=0 else 'absent','pidfd_available':True,'subreaper_get_supported':subreaper_get==0,'account':pwd.getpwuid(os.getuid()).pw_name,'uid':os.getuid(),'gid':os.getgid(),'store':meta(store),'destination':meta(store/digest),'stage':meta(stage),'memory_available_bytes':int(mem['MemAvailable'].split()[0])*1024,'disk_free_bytes':shutil.disk_usage(store).free,'load_average':list(os.getloadavg()),'cpu_count':os.cpu_count(),'cpu_busy_fraction':busy,'cpu_sample_seconds':1,'node_addresses':nodes[0]['status']['addresses'],'node_ready':any(c['type']=='Ready' and c['status']=='True' for c in nodes[0]['status']['conditions'])}))'''


def sha(path):
    with path.open('rb') as stream:return 'sha256:'+hashlib.file_digest(stream,'sha256').hexdigest()


def command(argv,timeout=60):
    cp=subprocess.run(argv,stdout=subprocess.PIPE,stderr=subprocess.DEVNULL,timeout=timeout)
    if cp.returncode:raise RuntimeError('command_failed')
    return cp.stdout


def ssh(code,args=(),timeout=60):
    remote='/usr/bin/python3 -I -B -c '+shlex.quote(code)
    if args:remote+=' '+' '.join(shlex.quote(str(x)) for x in args)
    return json.loads(command(['ssh','-o','BatchMode=yes','-o','ConnectTimeout=15','railiance01',remote],timeout))


def preflight():
    inputs=json.loads((HERE/'action-inputs.json').read_text())
    for name,expected in inputs['helper_hashes'].items():
        if sha(HERE/name)!=expected:raise ValueError('helper_changed')
    observation=ssh(READ_TARGET,args=((HERE/'runtime.py').read_text(),))
    store=observation['store']
    expected={'device':2049,'inode':4751222}
    checks={
        'bwrap_parent_death_contract':observation['bwrap_die_with_parent_supported'] and observation['bwrap_version']=='bubblewrap 0.9.0' and 'PR_SET_PDEATHSIG' in observation['primary_manual_contract_excerpt'],
        'supervision_primitives':observation['pidfd_available'] and observation['subreaper_get_supported'],
        'account':observation['account']=='tegwick' and observation['uid']==1000 and observation['gid']==1000,
        'protected_store':store['uid']==1000 and store['gid']==1000 and store['mode']=='0o700' and store['directory'] and not store['symlink'] and store['device']==expected['device'] and store['inode']==expected['inode'],
        'exact_installed_runtime':observation['destination'] is not None and observation['destination']['directory'] and not observation['destination']['symlink'] and observation['destination']['uid']==1000 and observation['destination']['gid']==1000 and observation['installed_complete_digest']==DIGEST,
        'durable_receipt_absent':observation['durable_receipt'] is None,
        'staging_absent':observation['stage'] is None,
        'exact_ready_node':observation['node_ready'] and any(x['address']=='92.205.62.239' for x in observation['node_addresses']),
        'disk_headroom':observation['disk_free_bytes']>=2*1024**3,
        'memory_headroom':observation['memory_available_bytes']>=1024**3,
        'load_headroom':observation['load_average'][0]<=2*observation['cpu_count'],
        'cpu_headroom':observation['cpu_busy_fraction']<=0.85,
    }
    observation['checks']=checks
    return inputs,observation


def save(path,value):
    fd=os.open(path,os.O_WRONLY|os.O_CREAT|os.O_EXCL|os.O_NOFOLLOW,0o600)
    with os.fdopen(fd,'w') as stream:json.dump(value,stream,indent=2);stream.write('\n')


def main():
    parser=argparse.ArgumentParser(description=__doc__)
    parser.add_argument('--apply',action='store_true');parser.add_argument('--dry-run',action='store_true')
    args=parser.parse_args()
    if args.apply and args.dry_run:raise ValueError('conflicting_modes')
    inputs,observation=preflight()
    if not args.apply:
        report={'status':'read_only_dry_run_passed' if all(observation['checks'].values()) else 'read_only_dry_run_blocked','proposal_id':inputs['proposal_id'],'revision':3,
                'observed_at':datetime.now(timezone.utc).isoformat(),'target':observation,
                'installed_runtime_complete_digest_verified':observation['installed_complete_digest']==DIGEST,
                'remote_mutations':0,'provider_calls':0,'private_configuration_reads':False,
                'next_exact_command':'python3 -I -B '+str(HERE/'execute-verify.py')+' --apply'}
        print(json.dumps(report,sort_keys=True));return 0 if all(observation['checks'].values()) else 2
    if not all(observation['checks'].values()):raise ValueError('target_headroom_or_identity_refused')
    receipt=HERE/'execution-receipt.json'
    if receipt.exists():raise ValueError('prior_attempt_requires_reconciliation')
    save(receipt,{'status':'intent_recorded','proposal_id':inputs['proposal_id'],'revision':3,
                  'automatic_retry':False,'observed_at':datetime.now(timezone.utc).isoformat()})
    # No native attempt is retried by this helper. Intent survives an SSH loss.
    create=r'''import json,os,stat,time
from pathlib import Path
assert os.getuid()==1000 and os.getgid()==1000
store=Path('/home/tegwick/.helixforge-factory/runtimes');s=store.lstat()
assert stat.S_ISDIR(s.st_mode) and s.st_uid==1000 and stat.S_IMODE(s.st_mode)==0o700 and s.st_ino==4751222 and s.st_dev==2049
assert (store/'f59959b605a51abd2901becde14e7abd852c2bd3f848004b51d250d1cb81af6d').is_dir()
assert not Path('/home/tegwick/.helixforge-factory/runtime-verify-f599-r3-20261017.receipt.json').exists()
read_cpu=lambda:[int(x) for x in Path('/proc/stat').read_text().splitlines()[0].split()[1:9]]
a=read_cpu();time.sleep(1);b=read_cpu();d=[y-x for x,y in zip(a,b)];assert 1-(d[3]+d[4])/sum(d)<=0.85
stage=Path('/home/tegwick/.helixforge-factory/runtime-verify-f599-r3-20261017');stage.mkdir(mode=0o700)
s=stage.lstat();print(json.dumps({'inode':s.st_ino,'device':s.st_dev}))'''
    created=ssh(create)
    receipt.write_text(json.dumps({'status':'staging_created','phase':'before_transfer','proposal_id':inputs['proposal_id'],'revision':3,'automatic_retry':False,'staging_identity':created,'staging_path':STAGE},indent=2)+'\n')
    command(['scp','-q',str(HERE/'runtime.py'),str(HERE/'verify-installed.py'),str(HERE/'process_supervision.py'),'railiance01:'+STAGE+'/'],120)
    execute=r'''import hashlib,json,os,stat,sys
from pathlib import Path
stage=Path('/home/tegwick/.helixforge-factory/runtime-verify-f599-r3-20261017');s=stage.lstat()
assert stat.S_ISDIR(s.st_mode) and s.st_uid==1000 and stat.S_IMODE(s.st_mode)==0o700 and s.st_ino==int(sys.argv[1]) and s.st_dev==2049
expected=json.loads(sys.argv[2]);assert {p.name for p in stage.iterdir()}==set(expected)
for name,want in expected.items():
 p=stage/name;s=p.lstat();assert stat.S_ISREG(s.st_mode) and s.st_uid==1000 and not stat.S_ISLNK(s.st_mode)
 with p.open('rb') as stream:assert hashlib.file_digest(stream,'sha256').hexdigest()==want
 p.chmod(0o600)
os.execve('/usr/bin/python3',['python3','-I','-B',str(stage/'verify-installed.py'),'--stage-inode',sys.argv[1]],{'HOME':'/home/tegwick','PATH':'/usr/bin:/bin','LANG':'C.UTF-8','PYTHONDONTWRITEBYTECODE':'1'})'''
    hashes={'runtime.py':inputs['helper_hashes']['runtime.py'].removeprefix('sha256:'),
            'verify-installed.py':inputs['helper_hashes']['verify-installed.py'].removeprefix('sha256:'),
            'process_supervision.py':inputs['helper_hashes']['process_supervision.py'].removeprefix('sha256:')}
    # Parse the structured final helper return even when its action failed.
    remote='/usr/bin/python3 -I -B -c '+shlex.quote(execute)+' '+shlex.quote(str(created['inode']))+' '+shlex.quote(json.dumps(hashes,separators=(',',':')))
    receipt.write_text(json.dumps({'status':'remote_execution_started','proposal_id':inputs['proposal_id'],'revision':3,'automatic_retry':False,'staging_identity':created,'staging_path':STAGE},indent=2)+'\n')
    cp=subprocess.run(['ssh','-o','BatchMode=yes','-o','ConnectTimeout=15','railiance01',remote],stdout=subprocess.PIPE,stderr=subprocess.DEVNULL,timeout=600)
    try:result=json.loads(cp.stdout)
    except Exception:raise RuntimeError('remote_outcome_uncertain') from None
    result['ssh_exit_code']=cp.returncode;result['staging_identity']=created
    # Replace only our exact local intent receipt, never a previous attempt.
    receipt.write_text(json.dumps(result,indent=2)+'\n');receipt.chmod(0o600)
    print(json.dumps(result,sort_keys=True))
    return 0 if cp.returncode==0 and result.get('status')=='installed_runtime_offline_rehearsal_verified' else 1


if __name__=='__main__':
    try:raise SystemExit(main())
    except Exception as exc:
        print(json.dumps({'status':'failed_or_uncertain','failure_type':type(exc).__name__,
                          'automatic_retry':False,'private_diagnostics_suppressed':True}))
        raise SystemExit(1) from None