"""External recorder for the parent-approved verifier and finite controls; no Cargo."""
from datetime import datetime, timezone
from pathlib import Path
import hashlib
import json
import subprocess
import sys
import time
import zipfile

LOCAL = Path(__file__).resolve().parent
REPO = LOCAL.parent
ORIGINAL = LOCAL / 'peer-union-e34-evidence-proposal-20260923'
PACKAGE = LOCAL / 'peer-union-e34-evidence-proposal-v2-20260923'
DRIVER = LOCAL / 'e34-evidence-v2-controls.py'
OUT = LOCAL / 'e34-evidence-v2-verification-run-20260923-1'
VERIFIER_SHA = '2e2186141957d9490fecd8ada6956aa1419510602735007b287b36235ae477a8'
DRIVER_SHA = '2e624c13cdac7db5f87859b90284f43174876c1d6d68d65afd6ca179528b5be1'


def pin(raw):
    return {'bytes': len(raw), 'sha256': hashlib.sha256(raw).hexdigest()}


def write(name, value):
    (OUT / name).write_text(json.dumps(value, indent=2) + '\n', encoding='utf-8', newline='\n')


def snapshot():
    watched = sorted([*ORIGINAL.iterdir(), *PACKAGE.iterdir(),
                      LOCAL / 'verify-e34-evidence-v2.py', LOCAL / 'package-e34-evidence-v2.py',
                      DRIVER, LOCAL / 'e34-evidence-v2-review.diff', Path(__file__).resolve()])
    git = lambda *args: subprocess.check_output(['git', *args], cwd=REPO).decode().strip()
    with zipfile.ZipFile(PACKAGE / 'evidence.zip') as archive:
        inputs = json.loads(archive.read('gates/combined-workspace-full-e34-1.inputs.json'))
    observed = [{'path': item['path'], **pin((REPO / item['path']).read_bytes())} for item in inputs['inputs']]
    return {'head': git('rev-parse', 'HEAD'), 'tree': git('rev-parse', 'HEAD^{tree}'),
            'tracked_status': git('status', '--porcelain', '--untracked-files=no'),
            'inputs': observed, 'inputs_match_recorded': observed == inputs['inputs'],
            'watched': {str(path.relative_to(REPO)): pin(path.read_bytes()) for path in watched}}


def run(label, argv):
    start = datetime.now(timezone.utc).isoformat()
    begin = time.monotonic_ns()
    with (OUT / (label + '.stdout.txt')).open('xb') as stdout, (OUT / (label + '.stderr.txt')).open('xb') as stderr:
        result = subprocess.run(argv, cwd=REPO, stdout=stdout, stderr=stderr)
    receipt = {'argv': argv, 'cwd': str(REPO), 'start_utc': start,
               'end_utc': datetime.now(timezone.utc).isoformat(), 'duration_monotonic_ns': time.monotonic_ns() - begin,
               'exit': result.returncode,
               'stdout': pin((OUT / (label + '.stdout.txt')).read_bytes()),
               'stderr': pin((OUT / (label + '.stderr.txt')).read_bytes())}
    write(label + '.result.json', receipt)
    print(json.dumps({'label': label, **receipt}), flush=True)
    return result.returncode


def main():
    assert pin((PACKAGE / 'verify.py').read_bytes())['sha256'] == VERIFIER_SHA
    assert pin(DRIVER.read_bytes())['sha256'] == DRIVER_SHA
    OUT.mkdir()
    before = snapshot()
    write('before.json', before)
    assert before['head'] == 'e34ba27e26ede3ab55f276acc250d92b2e0c3204'
    assert before['tree'] == '29f769926e2e907f0b40c3b33ec36658ee6601b7'
    assert before['inputs_match_recorded'] and not before['tracked_status']
    controls_exit = None
    try:
        positive_exit = run('positive', [sys.executable, str(PACKAGE / 'verify.py'), '--repo', str(REPO)])
        positive_pass = positive_exit == 0
        if positive_pass:
            positive_pass = json.loads((OUT / 'positive.stdout.txt').read_bytes())['status'] == 'RECORDED_E34_GATES_VERIFIED'
        if positive_pass:
            controls_exit = run('controls', [sys.executable, str(DRIVER), '--repo', str(REPO), '--out', str(OUT / 'controls')])
    finally:
        after = snapshot()
        write('after.json', after)
        write('integrity.json', {'source_unchanged': before['head'] == after['head'] and before['tree'] == after['tree']
                                and before['tracked_status'] == after['tracked_status'] and before['inputs'] == after['inputs'],
                                'watched_unchanged': before['watched'] == after['watched'],
                                'before': pin((OUT / 'before.json').read_bytes()),
                                'after': pin((OUT / 'after.json').read_bytes())})
    print(json.dumps({'folder': str(OUT), 'positive_pass': positive_pass, 'controls_exit': controls_exit,
                      'source_unchanged': before['inputs'] == after['inputs'],
                      'watched_unchanged': before['watched'] == after['watched']}), flush=True)
    return 0 if positive_pass and controls_exit == 0 and before == after else 1


if __name__ == '__main__':
    if not __debug__:
        raise SystemExit('Optimized Python is not supported')
    sys.exit(main())