#!/usr/bin/env python3
"""Independent read-only final inventory and cleanup audit for the exact cohort."""
import argparse
import datetime
import hashlib
import importlib.util
import json
from pathlib import Path
import shlex
import subprocess
import sys

HERE=Path(__file__).parent
s=importlib.util.spec_from_file_location('expand',HERE/'expand_forge_profiles.py')
m=importlib.util.module_from_spec(s)
s.loader.exec_module(m)


def main():
    parser=argparse.ArgumentParser(description=__doc__)
    parser.add_argument('--inventory',type=Path,required=True)
    parser.add_argument('--fresh-inventory',type=Path,required=True)
    parser.add_argument('--inventory-receipt',type=Path,required=True)
    parser.add_argument('--receipt',type=Path,required=True)
    args=parser.parse_args()
    p=json.loads((HERE/'forge-expansion-proposal.json').read_text())
    activation=Path('docs/evidence/2026-10-13-netkingdom-security/forge-expansion-activation.json')
    a=json.loads(activation.read_text())
    assert a['result']=='verified' and a['ownership_markers_removed'] and a['vetoes_removed'],'activation-not-complete'
    assert a['proposal_sha256']==hashlib.sha256((HERE/'forge-expansion-proposal.json').read_bytes()).hexdigest()
    assert len(a['verified_ids'])==len(set(a['verified_ids']))==p['target_count']
    assert set(a['verified_ids'])==set(a['attempted_ids'])==set(p['target_ids'])
    assert hashlib.sha256(args.inventory.read_bytes()).hexdigest()==p['inventory_sha256']
    old=json.loads(args.inventory.read_text());baseline={r['id'] for r in old['repositories'] if r['profile']=='admitted'}
    process=subprocess.run([sys.executable,str(HERE/'inventory_forge_coverage.py'),
        '--private-output',str(args.fresh_inventory),'--receipt',str(args.inventory_receipt)],capture_output=True,timeout=180)
    if process.returncode:raise ValueError('fresh-inventory-incomplete')
    fresh=json.loads(args.fresh_inventory.read_text());by_id={r['id']:r for r in fresh['repositories']}
    expected=baseline|set(p['target_ids'])
    assert all(by_id[i]['profile']=='admitted' for i in expected),'profile-not-preserved'
    assert not any(r['profile']=='unknown' for r in by_id.values()),'unknown-hook-profile'
    original=json.loads((HERE/'receive-hook-proposal.json').read_text())
    pod=m.t.target_pod(m.t.deployment(),original)
    assert pod['pod_uid']==fresh['pod_uid'],'pod-changed-during-final-audit'
    commands=['set -euo pipefail']
    for i in p['target_ids']:
        path=m.repo_path(by_id[i])
        commands += ['repo='+shlex.quote(path),
                     'test ! -e "$repo/hooks/pre-receive.d/'+p['veto_name']+'"',
                     'test ! -e "$repo/.custodian-expand-'+original['hook_name']+'"',
                     'test ! -e "$repo/.custodian-expand-'+p['veto_name']+'"',
                     'test -z "$(git --git-dir="$repo" for-each-ref --format=\'%(refname)\' '+shlex.quote(p['probe_ref'])+')"']
    m.t.native.execute(pod,'bash','-s',payload=('\n'.join(commands)+'\n').encode(),timeout=180)
    summary=json.loads(args.inventory_receipt.read_text())
    receipt={'result':'verified','observed_at':datetime.datetime.now(datetime.timezone.utc).isoformat(),
             'proposal_id':p['proposal_id'],'activation_receipt_sha256':hashlib.sha256(activation.read_bytes()).hexdigest(),
             'baseline_profiles_preserved':len(baseline),'expanded_profiles_verified':len(p['target_ids']),
             'current_profiles':summary['profiles'],'current_repositories':summary['repositories'],
             'no_probe_refs_or_vetoes_or_ownership_markers':True,
             'blocked_synthetic_commits_absent':'Verified separately by every native SSH probe in the activation receipt.',
             'remaining_builtin_only_ids':[r['id'] for r in by_id.values() if r['profile']=='builtin-only'],
             'api_route':'Unverified: protected route did not hand off; current capabilities check denied; attended login required.',
             'scope':'Exact native SSH scanner verdicts under ref-specific vetoes plus fresh hook/directory/custody and cleanup audit. Ordinary source acceptance remains separate; no full DSM conformance claimed.'}
    args.receipt.write_text(json.dumps(receipt,indent=2)+'\n');print(json.dumps(receipt))


if __name__=='__main__':main()