#!/usr/bin/env python3
# SPDX-License-Identifier: GPL-3.0-or-later
"""Validate the fail-closed Phase-0.6 exact-loader evidence."""

from __future__ import annotations

import argparse
import json
from pathlib import Path


def load(path: Path) -> dict[str, object]:
    document = json.loads(path.read_text(encoding="utf-8"))
    if not isinstance(document, dict):
        raise RuntimeError(f"{path}: expected an object")
    return document


def main() -> int:
    parser = argparse.ArgumentParser()
    parser.add_argument("--root", type=Path, required=True)
    args = parser.parse_args()
    root = args.root.resolve()

    audit = load(root / "manifests/runtime/phase-0.6-loader-runtime-audit.json")
    denylist = load(root / "manifests/artifact-denylist.json")

    decision = "BLOCKED_VERSION_OR_UNBOUNDED_EFFECT"
    if audit.get("decision") != decision:
        raise RuntimeError("Phase-0.6 no longer fails closed")
    if audit["artifact"]["built"] is not False:
        raise RuntimeError("Phase-0.6 unexpectedly produced an ELF")
    if audit["identity"]["elfldr"]["installed_asset_hash_match"] is not True:
        raise RuntimeError("installed elfldr exact identity is no longer proven")
    if audit["identity"]["payload_manager"]["installed_asset_hash_match"] is not True:
        raise RuntimeError("installed Payload Manager exact identity is no longer proven")
    if audit["identity"]["exact_exploit_autoloader"]["identified"] is not False:
        raise RuntimeError("unproven exploit identity was promoted without evidence")
    if any(audit["no_console_actions"].values()):
        raise RuntimeError("Phase-0.6 records a forbidden console action")

    effects = {item["id"]: item for item in audit["effects"]}
    for required in (
        "ptrace_single_step_completion",
        "payload_runtime_limit",
        "payload_manager_launch_hash_binding",
        "payload_manager_upload",
    ):
        if required not in effects or effects[required]["blocker"] is not True:
            raise RuntimeError(f"hard blocker disappeared: {required}")
    if effects["payload_manager_upload"]["classification"] != "PERSISTENT_WRITE":
        raise RuntimeError("Payload Manager upload write was reclassified")
    if (
        effects["ptrace_single_step_completion"]["classification"]
        != "UNBOUNDED_OR_UNKNOWN"
    ):
        raise RuntimeError("elfldr single-step loop was reclassified")

    blocked_hash = (
        "4be1c17b4964f2b68c39b5145bc4af4619c32512d60269ecf5c39728b390fa63"
    )
    if [entry["sha256"] for entry in denylist["entries"]] != [blocked_hash]:
        raise RuntimeError("permanent denylist changed")

    print("Phase-0.6 exact-loader audit remains fail-closed")
    return 0


if __name__ == "__main__":
    raise SystemExit(main())