#!/usr/bin/env python3
# SPDX-License-Identifier: GPL-3.0-or-later
"""Validate the committed Phase-0.7 offline deployment evidence."""

from __future__ import annotations

import argparse
import json
from pathlib import Path


def load(path: Path) -> dict[str, object]:
    document = json.loads(path.read_text(encoding="utf-8"))
    if not isinstance(document, dict):
        raise RuntimeError(f"{path}: expected an object")
    return document


def main() -> int:
    parser = argparse.ArgumentParser()
    parser.add_argument("--root", type=Path, required=True)
    args = parser.parse_args()
    root = args.root.resolve()
    audit = load(root / "manifests/runtime/phase-0.7-offline-audit.json")
    profile = load(root / "manifests/runtime/controlled-ps5-runtime-profile.json")
    manifest = load(
        root
        / "manifests/artifacts/chimera-gfx-lifecycle-probe-phase07-fw-9.60.json"
    )
    loader_manifest = load(
        root / "manifests/artifacts/chimera-elfldr-phase07-fw-9.60.json"
    )
    manager_manifest = load(
        root
        / "manifests/artifacts/chimera-payload-manager-phase07-fw-9.60.json"
    )
    proof = load(
        root / "manifests/runtime/phase-0.7-kernelwrite-proof-matrix.json"
    )
    denylist = load(root / "manifests/artifact-denylist.json")

    decision = "READY_FOR_HARDENED_RUNTIME_DEPLOYMENT"
    if audit.get("decision") != decision or profile.get("decision") != decision:
        raise RuntimeError("Phase-0.7 deployment decision is inconsistent")
    if proof.get("decision") != decision:
        raise RuntimeError("Phase-0.7 proof-matrix decision is inconsistent")
    if proof.get("kernelwrite_free_claim") is not False:
        raise RuntimeError("Phase-0.7 incorrectly claims kernelwrite-free startup")
    if any(audit["ps5_actions"].values()):
        raise RuntimeError("Phase-0.7 records a forbidden PS5 action")
    if audit["firmware"] != "9.60":
        raise RuntimeError("Phase-0.7 firmware gate changed")

    lifecycle = audit["artifacts"]["lifecycle"]
    if lifecycle["imports"] != ["_exit", "sceKernelSendNotificationRequest"]:
        raise RuntimeError("lifecycle import inventory changed")
    if lifecycle["dt_needed"] != [
        "libSceLibcInternal.sprx",
        "libkernel_web.sprx",
    ]:
        raise RuntimeError("lifecycle DT_NEEDED inventory changed")
    if lifecycle["byte_identical_clean_builds"] is not True:
        raise RuntimeError("lifecycle reproducibility evidence is absent")
    sensitive = lifecycle["sensitive_static_inventory"]
    if sensitive["direct_call_reachability_available"] is not True:
        raise RuntimeError("lifecycle direct reachability evidence is absent")
    kernel_runtime = sensitive["categories"]["kernel_runtime_write"]
    for required in (
        "__patch_init",
        "kernel_copyin",
        "kernel_copyout",
        "kernel_set_ucred_attrs",
        "kernel_set_ucred_caps",
    ):
        if required not in kernel_runtime["directly_reachable_from_entrypoint"]:
            raise RuntimeError(f"lifecycle hides reachable CRT symbol {required}")
    dynamic_loading = sensitive["categories"]["dynamic_loading"]["linked"]
    for required in ("sceKernelLoadStartModule", "sceKernelStopUnloadModule"):
        if required not in dynamic_loading:
            raise RuntimeError(f"lifecycle hides linked rtld symbol {required}")
    if sensitive["categories"]["graphics_or_display"]["linked"]:
        raise RuntimeError("lifecycle links a graphics/display-sensitive symbol")
    if lifecycle["sha256"] != manifest["artifact"]["sha256"]:
        raise RuntimeError("lifecycle audit/manifest hash mismatch")
    if lifecycle["size"] != manifest["artifact"]["size"]:
        raise RuntimeError("lifecycle audit/manifest size mismatch")
    loader = audit["artifacts"]["loader"]
    if (
        loader["sha256"] != loader_manifest["artifact"]["sha256"]
        or loader["size"] != loader_manifest["artifact"]["size"]
    ):
        raise RuntimeError("loader audit/manifest identity mismatch")
    manager = audit["artifacts"]["manager"]
    if (
        manager["sha256"] != manager_manifest["artifact"]["sha256"]
        or manager["size"] != manager_manifest["artifact"]["size"]
    ):
        raise RuntimeError("manager audit/manifest identity mismatch")
    for reviewed_manifest in (loader_manifest, manager_manifest, manifest):
        if reviewed_manifest["execution"]["execution_eligible"] is not True:
            raise RuntimeError("Phase-0.7 exact artifact is not statically eligible")
        if any(
            reviewed_manifest["execution"][key] is not False
            for key in ("authorized", "transferred", "executed")
        ):
            raise RuntimeError("Phase-0.7 manifest claims a forbidden action")
    for stripped in (loader, manager):
        inventory = stripped["sensitive_static_inventory"]
        if inventory["direct_call_reachability_available"] is not False:
            raise RuntimeError("stripped binary reachability is overstated")
        if inventory["categories"]["graphics_or_display"]["linked"]:
            raise RuntimeError("runtime links a graphics/display-sensitive symbol")
    if manifest["execution"]["execution_eligible"] is not True:
        raise RuntimeError("new lifecycle artifact is not statically eligible")
    if any(
        manifest["execution"][key] is not False
        for key in ("authorized", "transferred", "executed")
    ):
        raise RuntimeError("lifecycle manifest claims a forbidden action")

    if profile["hard_blockers"]:
        raise RuntimeError("Phase-0.7 profile still has hard blockers")
    classifications = {
        item["classification"] for item in profile["effects"]
    }
    if {"PERSISTENT_WRITE", "UNBOUNDED_OR_UNKNOWN"} & classifications:
        raise RuntimeError("Phase-0.7 profile still has a hard effect")
    if profile["firmware"]["evidence"] != "jens_explicitly_confirmed_exact_9.60":
        raise RuntimeError("explicit firmware confirmation is absent")
    if profile["deployment"] != {
        "installed": False,
        "ready_for_installation": True,
        "rollback_prepared": True,
    }:
        raise RuntimeError("Phase-0.7 deployment state changed")

    blocked = (
        "4be1c17b4964f2b68c39b5145bc4af4619c32512d60269ecf5c39728b390fa63"
    )
    if [entry["sha256"] for entry in denylist["entries"]] != [blocked]:
        raise RuntimeError("permanent denylist changed")
    proof_status = {
        item["component"]: item["status"] for item in proof["reviews"]
    }
    if proof_status.get("sdk_patch_init") != "UNSAFE":
        raise RuntimeError("normal CRT process-local write is hidden")
    if proof_status.get("firmware_9_60_runtime_behavior") != "UNPROVEN":
        raise RuntimeError("offline audit claims hardware evidence")
    if any(
        proof["no_ps5_actions"][key] is not False
        for key in ("connected", "installed", "transferred", "executed")
    ):
        raise RuntimeError("proof matrix claims a forbidden PS5 action")

    print("Phase-0.7 offline audit is deployment-ready and execution-unauthorized")
    return 0


if __name__ == "__main__":
    raise SystemExit(main())