"""Read-only, standard-library verification of this portable evidence archive."""
import hashlib
import json
from pathlib import Path, PurePosixPath
import re
import sys
import zipfile


ROOT = Path(__file__).resolve().parent


def require(condition, message):
    if not condition:
        raise ValueError(message)


def relative(name):
    p = PurePosixPath(name)
    require(name and not p.is_absolute() and ".." not in p.parts
            and "\\" not in name and ":" not in name
            and str(p) == name, f"Unsafe relative path: {name!r}")
    return p


def file(name):
    p = ROOT.joinpath(*relative(name).parts)
    require(p.resolve().is_relative_to(ROOT), f"Escaping file: {name}")
    return p


def identity(data):
    return {"bytes": len(data), "sha256": hashlib.sha256(data).hexdigest()}


def read_json(name):
    return json.loads(file(name).read_text(encoding="utf-8"))


def check_file(name, expected):
    require(identity(file(name).read_bytes()) == expected, f"Hash mismatch: {name}")


def unique(names):
    folded = [str(relative(n)).casefold() for n in names]
    require(len(folded) == len(set(folded)), "Duplicate/case-colliding paths")


def verify_oracles(index):
    """Check saved CLI reports and historical launch bindings, never binaries."""
    base = "native-preparation/"
    build = read_json("gates/windows-build-final-1/result.json")
    current = read_json(base + "current-oracle-1/result.json")
    candidate = read_json(base + "candidate-oracle-1/result.json")
    preserved = read_json(base + "windows-build-final-1-binaries/preserved.json")
    launch = read_json(base + "launch-manifest-final-1.json")
    # Resolve historical absolute evidence paths without accessing those paths.
    mapping = {}
    normalize = lambda path: path.replace("\\", "/").casefold()
    for group in index["payloadGroups"]:
        for name in group["files"]:
            mapping[normalize(group["sourceRoot"] + "/" + name)] = group["destinationPrefix"] + "/" + name
    for gate in index["completedGates"]:
        receipt = read_json("gates/" + gate["label"] + "/result.json")
        original = receipt["cwd"] + "/.local/text-diagnostic-gates/" + gate["label"]
        for name in ["inputs.json", "inputs.zip"]:
            mapping[normalize(original + "/" + name)] = gate["captureRef"] + "/" + name

    def bound(item):
        target = mapping.get(normalize(item["path"]))
        require(target is not None, "Unresolved archived evidence: " + item["path"])
        actual = identity(file(target).read_bytes())
        require(all(actual[k] == item[k] for k in ["bytes", "sha256"] if k in item),
                "Historical evidence binding differs: " + target)

    for item in [preserved["buildResult"], current["buildResult"], current["sourceResult"],
                 candidate["priorOracle"], *launch["evidence"]]:
        bound(item)
    check_file(base + "build-and-preserve.py", preserved["helper"])
    require(all(x["sourceInputs"] == build["inputs"] for x in [preserved, current, candidate, launch]),
            "Oracle/build/launch source identities differ")
    raw_artifacts = []
    for line in file("gates/windows-build-final-1/stdout.log").read_text(encoding="utf-8").splitlines():
        try:
            value = json.loads(line)
        except json.JSONDecodeError:
            continue
        if value.get("reason") == "compiler-artifact":
            raw_artifacts.append(value)
    for binary in preserved["binaries"]:
        matches = [a for a in build["artifacts"] if a["cargo"]["target"]["name"] == binary["name"]
                   and a["cargo"]["profile"]["test"] is False]
        require(len(matches) == 1 and matches[0]["cargo"] in raw_artifacts, "Build artifact missing")
        require(matches[0]["readback"] == {k: binary[k] for k in ["bytes", "sha256"]},
                "Preserved artifact receipt differs")
        require(normalize(binary["source"]) == normalize(matches[0]["cargo"]["executable"]),
                "Preserved source path differs")
    require(current["artifact"] in build["artifacts"]
            and current["binary"] == current["artifact"]["readback"], "CLI artifact binding differs")
    gui = next(b for b in preserved["binaries"] if b["name"] == "arcadia-studio")
    require(all(launch["binary"][k] == gui[k] for k in ["path", "bytes", "sha256"]),
            "Launch GUI receipt differs")
    # Executable/DLL bytes are deliberately external. Check only recorded identities.
    for path, pin in candidate["bindings"].items():
        if normalize(path) == normalize(current["binaryPath"]):
            require(pin == current["binary"], "Candidate CLI identity differs")
        elif normalize(path).endswith("/runtime/libunwind.dll"):
            require(pin == {"bytes": 190976, "sha256": "f45604a12e8bcd839fd86f667c1be1cc7c4f9da2b3c69ff381ac708f0e1ae7d4"},
                    "Candidate DLL identity differs")
        else:
            bound({"path": path, **pin})
    summaries = []
    for label, receipt, helper in [("current-oracle-1", current, "current-oracle.py"),
                                   ("candidate-oracle-1", candidate, "candidate-oracle.py")]:
        require(receipt["passed"] is True, "Oracle failed")
        check_file(base + helper, receipt["helper"])
        for run in receipt["runs"]:
            prefix = base + label + "/"
            for field, suffix in [("stdout", ".stdout.json"), ("stderr", ".stderr.log")]:
                check_file(prefix + run["label"] + suffix, run[field])
            report = read_json(prefix + run["label"] + ".stdout.json")
            require(report == run["report"], "Raw/parsed oracle report differs")
            require(run["exitCode"] == run["expectedExitCode"] == report["exit_code"]
                    and report["operation"] == "check" and report["written"] is False
                    and report["changes"] == [], "Oracle outcome differs")
            inputs = run.get("inputFiles", receipt.get("preparedFixtures", {}).get(run["label"]))
            for name, pin in inputs.items():
                check_file(prefix + run["label"] + "/" + name, pin)
            for diagnostic in report["diagnostics"]:
                location = diagnostic["location"]
                raw = file(prefix + run["label"] + "/" + location["path"]).read_bytes()
                start, end = location["start"], location["end"]
                require(0 <= start <= end <= len(raw), "Diagnostic range outside source")
                before = raw[:start].decode("utf-8")
                raw[start:end].decode("utf-8")
                raw[end:].decode("utf-8")
                require(location["line"] == before.count("\n") + 1
                        and location["column"] == len(before.rsplit("\n", 1)[-1]) + 1,
                        "Diagnostic line/column differs")
                require(diagnostic["coordinate_space"] == "input" and diagnostic["related"] == [],
                        "Unexpected oracle coordinate space or related locations")
            if "expectedSpan" in run:
                require(len(report["diagnostics"]) == 1, "Candidate diagnostic count differs")
                loc = report["diagnostics"][0]["location"]
                require([loc["start"], loc["end"]] == run["expectedSpan"], "Candidate span differs")
                original = file(base + "current-oracle-1/complete/functions.arcadia").read_bytes()
                raw = file(prefix + run["label"] + "/functions.arcadia").read_bytes()
                require(raw == original + bytes.fromhex(run["suffixHex"]), "Candidate literal edit differs")
            summaries.append({"oracle": label, "variant": run["label"], "exitCode": run["exitCode"],
                              "diagnostics": len(report["diagnostics"])})
    require([s["diagnostics"] for s in summaries] == [2, 5, 1, 1], "Oracle diagnostic counts differ")
    return summaries


def verify_native_trials(index):
    summaries = []
    normalize = lambda path: path.replace("\\", "/").casefold()
    mapping = {normalize(g["sourceRoot"] + "/" + name): g["destinationPrefix"] + "/" + name
               for g in index["payloadGroups"] for name in g["files"]}
    for trial in index.get("nativeTrials", []):
        prefix = trial["prefix"]
        launch = read_json(prefix + "/launch.json")
        closed = read_json(prefix + "/closed.json")
        review = read_json(trial["review"])
        require(closed == review["closure"] and closed["pid"] == launch["pid"]
                and closed["exitCode"] == 0 and closed["launchReceiptError"] is None,
                "Native closure binding differs")
        require(all(closed[k] is True for k in ["binaryUnchanged", "preservedBinaryUnchanged",
                                               "sameFileAfterExit", "dllUnchanged"])
                and launch["sameFileBeforeLaunch"] is True, "Native readback receipt differs")
        for key in ["stdout", "stderr"]:
            check_file(prefix + "/" + key + ".log", closed[key])
            require(closed[key]["bytes"] == 0, "Initial native log is not empty")
        raw_manifest = file(prefix + "/launch-manifest.json").read_bytes()
        require(identity(raw_manifest)["sha256"] == launch["manifestSha256"]
                and raw_manifest == file("native-preparation/launch-manifest-final-1.json").read_bytes(),
                "Native launch manifest differs")
        manifest = json.loads(raw_manifest)
        require(launch["binary"] == {k: manifest["binary"][k] for k in ["bytes", "sha256"]}
                == review["binary"], "Native binary receipt differs")
        check_file("native-preparation/launch.py", launch["helper"])
        for original, pin in review["bindings"].items():
            target = mapping.get(normalize(original))
            require(target is not None, "Unresolved native review evidence")
            check_file(target, pin)
        screenshots = file(prefix + "/screenshots")
        images = {x.name for x in screenshots.iterdir() if x.suffix == ".jpg"}
        metadata = sorted(x for x in screenshots.iterdir() if x.suffix == ".json")
        require(len(images) == trial["screenshots"] == review["screenshotCount"] == 19
                and len(metadata) == trial["metadata"] == review["metadataCount"] == 15,
                "Native capture counts differ")
        linked_images = []
        for path in metadata:
            data = json.loads(path.read_text(encoding="utf-8"))
            for capture in data["screenshots"]:
                name = capture["file"]
                require(len(relative(name).parts) == 1 and name in images, "Missing screenshot reference")
                linked_images.append(name)
        require(len(linked_images) == len(images) and set(linked_images) == images,
                "Native screenshot/metadata membership differs")
        fixture = {x.relative_to(file(prefix + "/work-fixture")).as_posix(): identity(x.read_bytes())
                   for x in file(prefix + "/work-fixture").rglob("*") if x.is_file()}
        current = read_json("native-preparation/current-oracle-1/result.json")
        require(fixture == review["workFixture"] == current["preparedFixtures"]["complete"],
                "Native saved fixture differs")
        require(review["originalFixtures"] == current["fixtures"], "Original fixture review differs")
        summaries.append({"prefix": prefix, "exitCode": 0, "screenshots": len(images),
                          "metadata": len(metadata), "acceptance": False})
    return summaries


def verify_resource_recovery(index):
    record = index.get("resourceRecovery")
    if not record:
        return None
    reclaim = read_json(record["reclaimedZIPReceipt"])
    require(len(reclaim["files"]) == 11, "Reclaimed ZIP receipt count differs")
    seen = set()
    for item in reclaim["files"]:
        original = item["path"].replace("\\", "/")
        require(original not in seen and original.endswith("/inputs.zip"), "Duplicate reclaimed path")
        seen.add(original)
        label = original.split("/")[-2]
        gate = next(g for g in index["completedGates"] if g["label"] == label)
        relative_zip = gate["captureRef"] + "/inputs.zip"
        require(item["retained"].replace("\\", "/").endswith(
                    "/harness/experiments/text-diagnostics-20260913/" + relative_zip),
                "Reclaimed ZIP retained path differs")
        pin = {k: item[k] for k in ["bytes", "sha256"]}
        check_file(relative_zip, pin)
        require(pin == read_json("gates/" + label + "/result.json")["archive"],
                "Reclaimed ZIP gate binding differs")
    require(sum(x["bytes"] for x in reclaim["files"]) == reclaim["reclaimed"],
            "Reclaimed byte total differs")
    before = read_json(record["compressionBefore"])
    result = read_json(record["compressionResult"])
    require(len(before) == result["files"] == 1040
            and len({x["path"].casefold() for x in before}) == len(before)
            and sum(x["bytes"] for x in before) == result["bytes"], "Compression inventory differs")
    require(result["exitCodes"] == [0, 0] and result["allFileBytesUnchanged"] is True,
            "Compression receipt did not report successful unchanged bytes")
    require(all(any(x["path"].casefold().startswith(root.casefold() + "\\")
                    for root in result["paths"]) for x in before), "Compression inventory outside recorded roots")
    second_summary = None
    if record.get("secondCompression"):
        second = record["secondCompression"]
        inventory = read_json(second["before"])
        receipt = read_json(second["result"])
        plan = read_json(second["plan"])
        require(identity(file(second["plan"]).read_bytes())["sha256"] == receipt["planSha256"],
                "Second compression plan hash differs")
        require(len(inventory) == receipt["files"] == 1048
                and sum(x["bytes"] for x in inventory) == receipt["bytes"],
                "Second compression count/size differs")
        by_path = {x["path"].casefold(): x for x in inventory}
        require(len(by_path) == len(inventory), "Duplicate second compression file")
        binaries = {x["path"].casefold(): x for x in plan["binaries"]}
        for path, binary in binaries.items():
            require(path in by_path and all(by_path[path][k] == binary[k] for k in ["bytes", "sha256"]),
                    "Second compression binary inventory differs")
        require(all(path in binaries or any(path.startswith(x["path"].casefold() + "\\")
                    for x in plan["caches"]) for path in by_path), "Second compression file outside plan")
        require(len(plan["binaries"]) + len(plan["caches"]) == 9
                and receipt["exitCodes"] == [0] * 9 and receipt["allFileBytesUnchanged"] is True,
                "Second compression receipt did not report successful unchanged bytes")
        second_summary = {"filesRecorded": 1048, "operationsRecorded": 9,
                          "freeBytesAtReceipt": receipt["freeBytes"], "externalFilesRehashed": False}
    return {"reclaimedPrivateZIPs": 11, "retainedZIPBytesVerified": reclaim["reclaimed"],
            "compressionFilesRecorded": 1040, "externalCacheRehashed": False,
            "recoveryHelpersExecutedByVerifier": False, "secondCompression": second_summary}


def verify():
    manifest = read_json("files.json")
    unique(manifest)
    actual = {p.relative_to(ROOT).as_posix() for p in ROOT.rglob("*") if p.is_file()}
    require(actual == set(manifest) | {"files.json"}, "Archive file membership differs")
    for name, pin in manifest.items():
        check_file(name, pin)
    index = read_json("index.json")
    payload = {}
    for group in index["payloadGroups"]:
        require(len(group["files"]) == group["fileCount"], "Group count differs")
        require(sum(x["bytes"] for x in group["files"].values()) == group["bytes"],
                "Group size differs")
        for name, pin in group["files"].items():
            target = group["destinationPrefix"] + "/" + name
            require(target not in payload, "Duplicate payload")
            require(manifest.get(target) == pin, f"Payload binding differs: {target}")
            payload[target] = pin
    require(len(payload) == index["totals"]["requiredPayloadFiles"], "Payload count differs")
    require(sum(p["bytes"] for p in payload.values()) == index["totals"]["requiredPayloadBytes"],
            "Payload total size differs")
    copies = read_json("copy-record.json")["files"]
    require(len(copies) == len(payload), "Copy receipt count differs")
    require({x["path"]: x["before"] for x in copies} == payload, "Copy source pins differ")
    require(all(x["before"] == x["after"] for x in copies), "Copy readbacks differ")

    members = 0
    for sha, capture in index["captures"].items():
        prefix = "captures/" + sha
        check_file(prefix + "/inputs.json", capture["inputsIdentity"])
        require(manifest[prefix + "/inputs.zip"]["sha256"] == sha, "Capture key differs")
        inputs = read_json(prefix + "/inputs.json")
        unique(inputs)
        require(len(inputs) == capture["inputCount"], "Captured input count differs")
        with zipfile.ZipFile(file(prefix + "/inputs.zip")) as archive:
            unique(archive.namelist())
            require(set(archive.namelist()) == set(inputs), "ZIP membership differs")
            for name, pin in inputs.items():
                # Reading each complete member also validates its ZIP CRC.
                require(identity(archive.read(name)) == pin, f"ZIP content differs: {name}")
        members += len(inputs)

    for gate in index["completedGates"]:
        prefix = "gates/" + gate["label"]
        result = read_json(prefix + "/result.json")
        started = read_json(prefix + "/started.json")
        require(all(result.get(k) == v for k, v in started.items()), "Started/result binding differs")
        capture = gate["captureRef"]
        require(capture == "captures/" + result["archive"]["sha256"], "Capture reference differs")
        require(gate["label"] in index["captures"][result["archive"]["sha256"]]["originalRuns"],
                "Capture run mapping differs")
        for field, name in [("inputs", capture + "/inputs.json"),
                            ("archive", capture + "/inputs.zip"),
                            ("stdout", prefix + "/stdout.log"), ("stderr", prefix + "/stderr.log")]:
            check_file(name, result[field])
        for key in ["command", "inputCount", "exitCode", "inputsUnchanged"]:
            require(gate[key] == result[key], f"Gate summary differs: {key}")
        if result.get("helper"):
            require(gate.get("helperRef") is not None, "Execution-pinned helper is unresolved")
            check_file(gate["helperRef"], result["helper"])
            require(result["environment"]["CARGO_INCREMENTAL"] == "0", "Runner environment differs")
        output = file(prefix + "/stdout.log").read_text(encoding="utf-8")
        groups = re.findall(r"test result: \w+\. (\d+) passed; (\d+) failed; (\d+) ignored; (\d+) measured; (\d+) filtered out", output)
        totals = dict(zip(["passed", "failed", "ignored", "measured", "filtered"],
                          [sum(int(m[i]) for m in groups) for i in range(5)]))
        require(totals == gate["totals"] and len(groups) == gate["groups"], "Test summary differs")

    prefix = "probe/records/attempt-1"
    result = read_json(prefix + "/result.json")
    for field, name in [("inputs", "inputs.json"), ("stdout", "stdout.log"), ("stderr", "stderr.log")]:
        check_file(prefix + "/" + name, result[field])
    inputs = read_json(prefix + "/inputs.json")
    require(len(inputs) == index["probe"]["frozenInputs"] == 77, "Probe count differs")
    for name, pin in inputs.items():
        check_file("probe/" + name, pin)
    require(result["exitCode"] == 0 and result["inputsUnchanged"], "Probe receipt differs")
    lines = file(prefix + "/stdout.log").read_text(encoding="utf-8").splitlines()
    require([line for line in lines if line.startswith("PASS ")] == result["passLine"],
            "Probe PASS binding differs")
    oracles = verify_oracles(index) if index.get("oracleRecords") else []
    trials = verify_native_trials(index)
    recovery = verify_resource_recovery(index)
    normalization = index.get("sourceNormalization")
    if normalization:
        receipt = read_json(normalization["receipt"])
        before_manifest = read_json(normalization["beforeCapture"] + "/inputs.json")
        after_manifest = read_json(normalization["afterCapture"] + "/inputs.json")
        member = normalization["member"]
        require(set(before_manifest) == set(after_manifest)
                and [name for name in before_manifest if before_manifest[name] != after_manifest[name]] == [member],
                "Normalization changed another input")
        with zipfile.ZipFile(file(normalization["beforeCapture"] + "/inputs.zip")) as archive:
            before = archive.read(member)
        with zipfile.ZipFile(file(normalization["afterCapture"] + "/inputs.zip")) as archive:
            after = archive.read(member)
        require(identity(before) == receipt["before"] and identity(after) == receipt["after"],
                "Normalization receipt source pins differ")
        lines = [number for number, line in enumerate(before.splitlines(keepends=True), 1) if line.endswith(b"\r\n")]
        require(lines == receipt["lines"] == [423, 424, 425]
                and before.replace(b"\r\n", b"\n") == after, "Normalization is not the exact three-pair change")
    return {"status": "PASS", "scope": "Archive bytes, ZIP members/CRC/content, gate/probe/oracle/native receipt bindings, saved spans and capture membership; no execution or binary revalidation",
            "manifestSha256": identity(file("files.json").read_bytes())["sha256"],
            "pinnedFiles": len(manifest), "payloadFiles": len(payload),
            "sourceCaptures": len(index["captures"]), "verifiedZIPMembers": members,
            "completedGates": len(index["completedGates"]), "probeInputs": len(inputs),
            "savedOracles": oracles, "closedNativeTrials": trials, "resourceRecovery": recovery,
            "sourceNormalizationVerified": bool(normalization)}


if __name__ == "__main__":
    try:
        print(json.dumps(verify(), indent=2))
    except (OSError, ValueError, KeyError, zipfile.BadZipFile) as error:
        print(f"FAIL: {error}", file=sys.stderr)
        sys.exit(1)