#!/usr/bin/env python3
# SPDX-License-Identifier: GPL-3.0-or-later
"""Validate the offline-only Phase-1.0J diagnostic artifact record."""

from __future__ import annotations

import argparse
import json
from pathlib import Path
import subprocess
from typing import Any


PHASE = "PHASE_1_0J_WRITE_FIREWALL_DIAGNOSTIC"
STATUS = "OFFLINE_ARTIFACT_AUDITED_DEVICE_ACTION_BLOCKED"
ARTIFACT_SHA256 = "6ff0f7ea391da5f15ea43512a871078133e896a6900ae9f8f3fa75711abb8009"
MAP_SHA256 = "19f1cf851ad8f99d31d5de3a14591f81faa83589c18e93cd60be96ebef5d7719"
DISASSEMBLY_SHA256 = "45dc4e0233b3770add430aaa6bb23a60210b50744effb76b515fca4b9e6e310f"
AUTHORIZATION_FIELDS = (
    "ps5_connection_authorized", "device_transfer_authorized",
    "device_execution_authorized", "result_receive_authorized",
    "target_build_authorized", "installation_authorized",
    "autoload_authorized", "device_write_authorized", "automatic_retry",
)
DEVICE_ACTION_FIELDS = (
    "ps5_connected", "device_request_performed", "files_transferred",
    "target_execution_performed", "result_received_from_device",
    "device_write_performed", "installation_performed", "autoload_performed",
    "retry_performed", "reconnect_performed",
)
DELIVERABLES = (
    "docs/adr/0012-phase10j-first-frame-identity.md",
    "docs/retroarch/phase-1.0j-write-firewall-diagnostic.md",
    "manifests/retroarch/phase-1.0j-write-firewall-diagnostic.json",
    "packaging/retroarch/phase10j/SHA256SUMS.txt",
    "tools/validate_retroarch_phase10j.py",
    "tests/test_retroarch_phase10j.py",
)


def load_json(path: Path) -> dict[str, Any]:
    value = json.loads(path.read_text(encoding="utf-8"))
    if not isinstance(value, dict):
        raise ValueError("Phase-1.0J manifest is not an object")
    return value


def all_false(record: dict[str, Any], fields: tuple[str, ...]) -> bool:
    return all(record.get(field) is False for field in fields)


def artifact_is_exact_and_ineligible(record: dict[str, Any]) -> bool:
    return (
        record.get("name") == "retroarch_ps5_write_diag.elf"
        and record.get("size") == 1845208
        and record.get("sha256") == ARTIFACT_SHA256
        and record.get("tracked") is False
        and record.get("execution_eligible") is False
        and record.get("transfer_eligible") is False
        and record.get("installation_eligible") is False
    )


def protocol_is_bounded(record: dict[str, Any]) -> bool:
    return (
        record.get("magic") == "CHD10J01"
        and record.get("new_stage") == "D13"
        and record.get("historical_stage_values_preserved") is True
        and record.get("d13_fields") == ["first_blocked_write", "write_block_count"]
        and record.get("d13_immediately_precedes_terminal_d12") is True
        and record.get("d13_stream_only") is True
        and record.get("target_socket_created") is False
        and record.get("live_runner_supports_j") is False
    )


def firewall_is_fail_closed(record: dict[str, Any]) -> bool:
    wrappers = record.get("surviving_wrappers", [])
    return (
        record.get("first_rejection_requests_shutdown") is True
        and record.get("stop_check_location") == "IMMEDIATELY_AFTER_RETROARCH_PARSE_INPUT_AND_CONFIG"
        and record.get("stop_before") == "I04"
        and record.get("stop_before_driver_lookup") is True
        and record.get("write_succeeds") is False
        and record.get("wrapper_errno") == "EROFS"
        and wrappers == [
            {"symbol": "__wrap_open", "address": "0x475a0", "operation": "OPEN"},
            {"symbol": "__wrap_fopen", "address": "0x47610", "operation": "OPEN"},
            {"symbol": "__wrap_fwrite", "address": "0x476a0", "operation": "STREAM"},
        ]
    )


def flip_instrumentation_is_bounded(record: dict[str, Any]) -> bool:
    return (
        record.get("submit_count_maximum_per_reached_helper") == 1
        and record.get("submit_errno_saved_immediately") is True
        and record.get("reporting_before_errno_save") is False
        and record.get("d07_fields_under_j") == ["submit_result", "saved_errno"]
        and record.get("wait_only_after_submit_success") is True
        and record.get("first_frame_source") == "CHIMERA_PS5_FIRST_FRAME_INDEX"
        and record.get("first_frame_value") == 0
        and record.get("firmware_semantics") == "UNPROVEN"
        and record.get("root_cause_claimed") is False
    )


def audit_is_bounded(record: dict[str, Any]) -> bool:
    relocations = record.get("relocations", {})
    forbidden_imports = (
        "socket_create_import", "connect_import", "listener_import",
        "receive_import",
    )
    return (
        record.get("entry_point") == "0xff210"
        and record.get("load_segment_permissions") == ["R_E", "R", "RW"]
        and record.get("rwx_load_segments") == 0
        and record.get("init_array_size") == 0
        and record.get("fini_array_size") == 0
        and record.get("tls_sections") == 0
        and record.get("undefined_dynamic_symbols") == 142
        and relocations == {
            "total": 1055,
            "R_X86_64_GLOB_DAT": 142,
            "R_X86_64_RELATIVE": 913,
        }
        and record.get("inherited_send_import_count") == 1
        and all(record.get(field) is False for field in forbidden_imports)
        and record.get("gnm_imports") == []
        and record.get("normalized_disassembly_sha256") == DISASSEMBLY_SHA256
        and record.get("string_absence_used_as_reachability_proof") is False
    )


def validate(root: Path) -> list[str]:
    errors: list[str] = []
    for relative in DELIVERABLES:
        if not (root / relative).is_file():
            errors.append(f"missing deliverable: {relative}")
    try:
        record = load_json(root / "manifests/retroarch/phase-1.0j-write-firewall-diagnostic.json")
    except (OSError, ValueError, json.JSONDecodeError) as error:
        return errors + [str(error)]
    if record.get("phase") != PHASE or record.get("status") != STATUS:
        errors.append("phase/status mismatch")
    if not artifact_is_exact_and_ineligible(record.get("artifact", {})):
        errors.append("artifact is not exact and ineligible")
    linker_map = record.get("linker_map", {})
    if not (
        linker_map.get("size") == 637728
        and linker_map.get("sha256") == MAP_SHA256
        and linker_map.get("tracked") is False
    ):
        errors.append("linker-map identity mismatch")
    if not protocol_is_bounded(record.get("protocol", {})):
        errors.append("J protocol is widened or incomplete")
    if not firewall_is_fail_closed(record.get("write_firewall", {})):
        errors.append("write firewall does not stop and report exactly")
    if not flip_instrumentation_is_bounded(record.get("flip_diagnostic", {})):
        errors.append("flip instrumentation overclaims or widens behavior")
    if not audit_is_bounded(record.get("artifact_audit", {})):
        errors.append("artifact audit is incomplete or overclaims reachability")
    reproducibility = record.get("reproducibility", {})
    if not (
        reproducibility.get("clean_builds") == 2
        and reproducibility.get("elf_byte_identical") is True
        and reproducibility.get("map_byte_identical") is True
        and reproducibility.get("normalized_disassembly_identical") is True
        and reproducibility.get("warnings_as_errors_for_retroarch_target") is True
    ):
        errors.append("reproducibility evidence is incomplete")
    actions = record.get("phase_actions", {})
    if not all_false(actions, DEVICE_ACTION_FIELDS):
        errors.append("Phase-1.0J records a device action")
    if actions.get("target_build_performed") is not True or actions.get("target_artifact_created") is not True:
        errors.append("offline target build is not recorded")
    if not all_false(record.get("current_authorizations", {}), AUTHORIZATION_FIELDS):
        errors.append("a current authorization is active")
    tests = record.get("tests", {})
    if not (
        tests.get("chimera_gfx_ctest") == "49_OF_49_PASS"
        and tests.get("retroarch_ps5_host_suite") == "PASS_WITH_ASAN_UBSAN"
        and tests.get("phase10j_gfx_guardrails") == 20
        and tests.get("phase10j_retroarch_guardrails") == 4
        and tests.get("safety_audit") == "PASS"
        and tests.get("secret_scan") == "PASS"
        and tests.get("hardware_evidence_from_phase10j") is False
    ):
        errors.append("test evidence is incomplete or promoted to hardware evidence")
    sums = (root / "packaging/retroarch/phase10j/SHA256SUMS.txt").read_text(encoding="utf-8")
    if ARTIFACT_SHA256 not in sums or MAP_SHA256 not in sums:
        errors.append("checksum record does not bind both ignored outputs")
    tracked = subprocess.run(
        ["git", "ls-files"], cwd=root, capture_output=True, text=True, check=True
    ).stdout.splitlines()
    forbidden_suffixes = (".elf", ".self", ".sprx", ".pkg", ".map")
    if any(path.lower().endswith(forbidden_suffixes) for path in tracked):
        errors.append("target artifact or map is tracked")
    return errors


def main() -> int:
    parser = argparse.ArgumentParser()
    parser.add_argument("--root", type=Path, required=True)
    args = parser.parse_args()
    errors = validate(args.root.resolve())
    if errors:
        for error in errors:
            print(f"ERROR: {error}")
        return 1
    print("Phase-1.0J offline diagnostic artifact validation passed")
    return 0


if __name__ == "__main__":
    raise SystemExit(main())