"""Read-only integrity verification of two isolated fidelity gates."""
from pathlib import Path
import hashlib
import json
import zipfile

root = Path(__file__).resolve().parent


def require(condition, message):
    if not condition:
        raise SystemExit(message)


def digest(data):
    return {'bytes': len(data), 'sha256': hashlib.sha256(data).hexdigest()}


def read_json(path):
    return json.loads(path.read_text(encoding='utf-8'))


manifest = read_json(root / 'files.json')
paths = {p.relative_to(root).as_posix() for p in root.rglob('*') if p.is_file() and p.name != 'files.json' and '__pycache__' not in p.parts}
require(paths == set(manifest), 'Archive membership mismatch')
for name, expected in manifest.items():
    require(digest((root / name).read_bytes()) == expected, f'File mismatch: {name}')
captured = {}
outcomes = {}
for name, count in [('fidelity-1', 9), ('fidelity-clippy-1', None)]:
    gate = root / name
    result = read_json(gate / 'result.json')
    require(all(result[k] == v for k, v in read_json(gate / 'started.json').items()), f'{name}: start mismatch')
    require(result['exitCode'] == 0 and result['inputsUnchanged'], f'{name}: failed/changed inputs')
    for key, filename in [('inputs','inputs.json'),('archive','inputs.zip'),('stdout','stdout.log'),('stderr','stderr.log')]:
        require(digest((gate / filename).read_bytes()) == result[key], f'{name}: {key} mismatch')
    require(digest((root / 'gate-policy.py').read_bytes()) == result['helper'], f'{name}: runner mismatch')
    inputs = read_json(gate / 'inputs.json')
    captured[name] = inputs
    require(len(inputs) == result['inputCount'] == 610, f'{name}: input count')
    require('harness/prototypes/source-defaults-20260913.rs' in inputs, f'{name}: compiled prototype missing')
    with zipfile.ZipFile(gate / 'inputs.zip') as archive:
        require(len(archive.namelist()) == len(inputs) and set(archive.namelist()) == set(inputs), f'{name}: ZIP membership')
        for path, expected in inputs.items():
            require(digest(archive.read(path)) == expected, f'{name}: input mismatch {path}')
    stdout = (gate / 'stdout.log').read_text(encoding='utf-8')
    if count is not None:
        require(f'test result: ok. {count} passed; 0 failed; 0 ignored;' in stdout, f'{name}: test summary')
        tests = [s for s in stdout.splitlines() if s.startswith('test ') and ' ... ' in s]
        require(len(tests) == count and all(s.endswith(' ... ok') for s in tests), f'{name}: named outcomes')
        outcomes[name] = {s.split()[1] for s in tests}
    else:
        require(result['command'][1] == 'clippy' and result['command'][-3:] == ['--','-D','warnings'], f'{name}: strict command')
    artifacts = []
    finished = False
    for line in stdout.splitlines():
        try:
            item = json.loads(line)
        except json.JSONDecodeError:
            continue
        if isinstance(item, dict) and item.get('reason') == 'compiler-artifact' and item.get('executable'):
            artifacts.append(item)
        if isinstance(item, dict) and item.get('reason') == 'build-finished':
            finished = item.get('success') is True
    require(finished, f'{name}: successful Cargo build record missing')
    require(artifacts == [a['cargo'] for a in result['artifacts']], f'{name}: artifacts mismatch')
    require(len(artifacts) == (1 if count else 0), f'{name}: artifact count')
require(captured['fidelity-1'] == captured['fidelity-clippy-1'], 'Test/lint inputs differ')
require('harness/prototypes/source-defaults-render-probe-20260913.rs' in captured['fidelity-1'], 'Adapter missing')
print(f'Verified {len(manifest)} pinned files, two 610-input gates, 9 passing fidelity tests and strict targeted Clippy.')
print('Recorded canonical-span experiment only; production editing and modular formatting are separate gates.')