"""Verify published receipts and immutable Git inputs; never run archived code."""
from pathlib import Path
import argparse
import hashlib
import json
import re
import subprocess
import sys
import zipfile

if sys.flags.optimize:
    raise SystemExit('Optimized Python is unsupported')
parser = argparse.ArgumentParser()
parser.add_argument('--repo', type=Path, required=True)
args = parser.parse_args()
base = Path(__file__).resolve().parent
source = '10d7f3340d5cd61a656dc0bcf7c143f8897c5551'
manifest = json.loads((base / 'manifest.json').read_text())
with zipfile.ZipFile(base / 'evidence.zip') as archive:
    assert len(archive.namelist()) == len(set(archive.namelist())) == 13
    assert set(archive.namelist()) == set(manifest)
    payload = {name: archive.read(name) for name in manifest}
for name, data in payload.items():
    assert manifest[name] == {'bytes':len(data), 'sha256':hashlib.sha256(data).hexdigest()}, name

receipts = {kind:json.loads(payload[f'{kind}-10d7f33.result.json']) for kind in ('list', 'typed', 'clippy')}
commands = {
    'list':['cargo','test','--locked','--offline','-p','oa-core','--lib','--','--list'],
    'typed':['cargo','test','--locked','--offline','-p','oa-core','--lib','language::analysis_source','--','--test-threads=1'],
    'clippy':['cargo','clippy','--locked','--offline','-p','oa-core','--all-targets','--','-D','warnings'],
}
inputs = None
for kind, receipt in receipts.items():
    assert receipt['source'] == receipt['head_after'] == source
    assert receipt['exit'] == 0 and receipt['changed_inputs'] == []
    assert receipt['command'] == commands[kind]
    assert receipt['start'] < receipt['end']
    assert receipt['environment']['CARGO_BUILD_JOBS'] == '1'
    assert receipt['launcher_sha256'] == hashlib.sha256(payload['runner.py']).hexdigest()
    current = json.loads(payload[receipt['inputs']])
    assert current['source'] == source and len(current['inputs']) == 538
    if inputs is None:
        inputs = current['inputs']
    assert current['inputs'] == inputs

listed = re.findall(r'^([^\r\n]+): test\r?$', payload['list-10d7f33.log'].decode(), re.M)
assert listed == receipts['list']['listing_members']
assert len(listed) == len(set(listed)) == receipts['list']['listing_count'] == 173
prior = json.loads(payload['prior-list-1b1c3e3.result.json'])
assert prior['source'] == '1b1c3e3abb6fc3d0934c9dbfbd21fddc8ae4f594' and prior['exit'] == 0
assert len(prior['listing_members']) == 167 and set(prior['listing_members']) <= set(listed)
new = {
    'composition_checks_edit_record_ceiling_before_duplicate_membership',
    'composition_defers_only_typed_output_size_with_independent_shrink_arithmetic',
    'composition_exports_complete_borrowed_swap_witnesses_and_empty_noops',
    'composition_keeps_name_storage_and_rename_record_limits_before_allocation',
    'composition_rejects_stale_or_damaged_complete_batches_before_export',
    'standalone_noop_apply_keeps_tighter_file_only_budget_and_output_boundary',
}
assert set(listed)-set(prior['listing_members']) == {'language::analysis_source::update::tests::'+name for name in new}
selected = {name for name in listed if name.startswith('language::analysis_source::')}
log = payload['typed-10d7f33.log'].decode()
passed = re.findall(r'^test ([^\r\n]+) \.\.\. ok\r?$', log, re.M)
assert len(passed) == len(set(passed)) == len(selected) == 65 and set(passed) == selected
assert '65 passed; 0 failed; 0 ignored; 0 measured; 108 filtered out' in log
assert receipts['list']['artifacts'] == receipts['typed']['artifacts']
assert len(receipts['typed']['artifacts']) == 1
assert receipts['typed']['artifacts'][0]['sha256'] == 'eed1520856679ecbea6ab2c3a202339775b7791cbfb2c24d74984cbde706305d'
assert 'Finished' in payload['clippy-10d7f33.log'].decode()

paths = subprocess.check_output(['git','ls-tree','-r','--name-only',source,'Cargo.toml','Cargo.lock','rust-toolchain.toml','.cargo','build','crates','assets','docs','examples','harness/fixtures','vendor'],cwd=args.repo).decode().splitlines()
assert paths == [item['path'] for item in inputs]
blobs = subprocess.check_output(['git','cat-file','--batch'],cwd=args.repo,input=''.join(f'{source}:{path}\n' for path in paths).encode())
offset = 0
for item in inputs:
    end = blobs.index(b'\n',offset)
    _,kind,size = blobs[offset:end].split()
    size = int(size)
    data = blobs[end+1:end+1+size]
    assert kind == b'blob' and size == item['bytes'] and hashlib.sha256(data).hexdigest() == item['sha256'],item['path']
    offset = end+size+2
assert offset == len(blobs)
print('PASS: 13 payloads; 538 immutable Git inputs; 173 listed, 167 retained + 6 new; exact 65 typed passes; strict core Clippy.')