#!/usr/bin/env python3
# SPDX-License-Identifier: GPL-3.0-or-later
"""Host-only policy tests for the Phase-1.0D diagnostic ladder."""

from __future__ import annotations

import argparse
import importlib.util
from pathlib import Path
import sys
from typing import Callable


def load_validator(path: Path):
    spec = importlib.util.spec_from_file_location("phase10d_validator", path)
    assert spec and spec.loader
    module = importlib.util.module_from_spec(spec)
    sys.modules[spec.name] = module
    spec.loader.exec_module(module)
    return module


def require(condition: bool, message: str) -> None:
    if not condition:
        raise RuntimeError(message)


def main() -> int:
    parser = argparse.ArgumentParser()
    parser.add_argument("--root", type=Path, required=True)
    args = parser.parse_args()
    root = args.root.resolve()
    validator = load_validator(root / "tools/validate_retroarch_phase10d.py")
    cases: list[tuple[str, Callable[[], None]]] = []

    def case(name: str):
        def register(function: Callable[[], None]) -> Callable[[], None]:
            cases.append((name, function))
            return function
        return register

    def canary() -> dict:
        return {
            "elf": {
                "undefined_symbols": sorted(validator.CANARY_IMPORTS),
                "dt_needed": sorted(validator.CANARY_NEEDED),
            },
            "notification_abi": {"maximum_attempts": 1, "retry": False},
            "behavior": {
                "sleep_attempts": 1,
                "interrupted_sleep_retry": False,
                **{
                    field: False for field in (
                        "retroarch", "sdl", "videoout", "pad", "audioout",
                        "filesystem", "networking", "threads", "autoload",
                        "installation",
                    )
                },
            },
        }

    def early() -> dict:
        return {
            "diagnostic": {
                "stages": [f"D{index:02d}" for index in range(13)],
                "notification_maximum_attempts_per_stage": 1,
                "notification_retry": False,
                "notification_failure_blocks_primary_path": False,
            },
            "first_frame": {
                "background": "MAGENTA",
                "fixed_rectangle": "WHITE",
                "embedded_pattern": "BLACK",
                "submit_attempts": 1,
                "retry": False,
                "second_buffer_initialization": False,
            },
            "profile_policy": {
                "write_firewall": True,
                **{
                    field: False for field in (
                        "filesystem_writes_allowed", "networking",
                        "dynamic_cores", "gnm", "autoload", "installation",
                        "payload_launch", "automatic_retry",
                    )
                },
            },
        }

    @case("01 false authorization set passes")
    def _() -> None:
        require(
            validator.all_false(
                {field: False for field in validator.AUTHORIZATION_FIELDS},
                validator.AUTHORIZATION_FIELDS,
            ),
            "closed authorization rejected",
        )

    @case("02 any authorization true fails")
    def _() -> None:
        values = {field: False for field in validator.AUTHORIZATION_FIELDS}
        values["device_execution_authorized"] = True
        require(
            not validator.all_false(values, validator.AUTHORIZATION_FIELDS),
            "execution authorization accepted",
        )

    @case("03 minimal canary passes")
    def _() -> None:
        require(validator.canary_is_minimal(canary()), "minimal canary rejected")

    @case("04 SDL canary import fails")
    def _() -> None:
        value = canary()
        value["elf"]["undefined_symbols"].append("SDL_Init")
        require(not validator.canary_is_minimal(value), "SDL canary accepted")

    @case("05 canary networking fails")
    def _() -> None:
        value = canary()
        value["behavior"]["networking"] = True
        require(not validator.canary_is_minimal(value), "network canary accepted")

    @case("06 canary notification retry fails")
    def _() -> None:
        value = canary()
        value["notification_abi"]["retry"] = True
        require(not validator.canary_is_minimal(value), "notification retry accepted")

    @case("07 complete D00-D12 ladder passes")
    def _() -> None:
        require(validator.early_ladder_is_closed(early()), "closed ladder rejected")

    @case("08 missing D07 fails")
    def _() -> None:
        value = early()
        value["diagnostic"]["stages"].remove("D07")
        require(not validator.early_ladder_is_closed(value), "missing D07 accepted")

    @case("09 duplicate notification policy fails")
    def _() -> None:
        value = early()
        value["diagnostic"]["notification_maximum_attempts_per_stage"] = 2
        require(not validator.early_ladder_is_closed(value), "duplicate accepted")

    @case("10 first flip retry fails")
    def _() -> None:
        value = early()
        value["first_frame"]["retry"] = True
        require(not validator.early_ladder_is_closed(value), "flip retry accepted")

    @case("11 second buffer initialization fails")
    def _() -> None:
        value = early()
        value["first_frame"]["second_buffer_initialization"] = True
        require(not validator.early_ladder_is_closed(value), "second init accepted")

    @case("12 filesystem writes fail")
    def _() -> None:
        value = early()
        value["profile_policy"]["filesystem_writes_allowed"] = True
        require(not validator.early_ladder_is_closed(value), "write accepted")

    @case("13 GNM fails")
    def _() -> None:
        value = early()
        value["profile_policy"]["gnm"] = True
        require(not validator.early_ladder_is_closed(value), "GNM accepted")

    @case("14 RX R RW passes")
    def _() -> None:
        headers = [
            {"type": "LOAD", "flags": "RE"},
            {"type": "LOAD", "flags": "R"},
            {"type": "LOAD", "flags": "RW"},
        ]
        require(validator.wx_closed(headers), "W^X layout rejected")

    @case("15 RWX fails")
    def _() -> None:
        headers = [
            {"type": "LOAD", "flags": "RWE"},
            {"type": "LOAD", "flags": "R"},
            {"type": "LOAD", "flags": "RW"},
        ]
        require(not validator.wx_closed(headers), "RWX accepted")

    @case("16 exact four model inputs pass")
    def _() -> None:
        record = {
            "model": {"hardware_evidence": False},
            "real_artifacts": [
                {
                    "name": name,
                    "sha256": "0" * 64,
                    "classification": "ACCEPTED_BY_STATIC_MODEL",
                }
                for name in validator.REAL_MODEL_ARTIFACTS
            ],
        }
        require(validator.model_result_set_is_complete(record), "model set rejected")

    @case("17 missing model input fails")
    def _() -> None:
        names = list(validator.REAL_MODEL_ARTIFACTS)[:-1]
        record = {
            "model": {"hardware_evidence": False},
            "real_artifacts": [
                {"name": name, "sha256": "0" * 64,
                 "classification": "ACCEPTED_BY_STATIC_MODEL"}
                for name in names
            ],
        }
        require(
            not validator.model_result_set_is_complete(record),
            "incomplete model set accepted",
        )

    @case("18 static model cannot be hardware evidence")
    def _() -> None:
        record = {
            "model": {"hardware_evidence": True},
            "real_artifacts": [
                {"name": name, "sha256": "0" * 64,
                 "classification": "ACCEPTED_BY_STATIC_MODEL"}
                for name in validator.REAL_MODEL_ARTIFACTS
            ],
        }
        require(
            not validator.model_result_set_is_complete(record),
            "hardware claim accepted",
        )

    def trace() -> dict:
        return {
            "connections": 1, "sendall_calls": 1, "hash_before_connect": True,
            "shutdown_called": False, "response_read": False, "retry": False,
            "reconnect": False, "probe": False,
            "cannot_prove": ["REMOTE_ELF_RECEIPT", "REMOTE_EXECUTION"],
        }

    @case("19 bounded sender trace passes")
    def _() -> None:
        require(validator.sender_trace_is_bounded(trace()), "bounded trace rejected")

    @case("20 sender retry fails")
    def _() -> None:
        value = trace()
        value["retry"] = True
        require(not validator.sender_trace_is_bounded(value), "sender retry accepted")

    @case("21 response read fails")
    def _() -> None:
        value = trace()
        value["response_read"] = True
        require(not validator.sender_trace_is_bounded(value), "response accepted")

    @case("22 reproducible hashes pass")
    def _() -> None:
        value = {
            "artifact": {
                "size": 1, "sha256": "a" * 64,
                "clean_build_sha256": ["a" * 64, "a" * 64],
                "linker_map_sha256": "b" * 64,
                "clean_map_sha256": ["b" * 64, "b" * 64],
            }
        }
        require(validator.reproducible_artifact(value), "reproducible rejected")

    @case("23 differing build hashes fail")
    def _() -> None:
        value = {
            "artifact": {
                "size": 1, "sha256": "a" * 64,
                "clean_build_sha256": ["a" * 64, "c" * 64],
                "linker_map_sha256": "b" * 64,
                "clean_map_sha256": ["b" * 64, "b" * 64],
            }
        }
        require(not validator.reproducible_artifact(value), "mismatch accepted")

    @case("24 future ladder remains non-authorizing")
    def _() -> None:
        text = (
            root / "docs/retroarch/phase-1.0d-next-device-test-ladder.md"
        ).read_text(encoding="utf-8")
        require(
            "device_execution_authorized=false" in text
            and "RUN A authority does not carry to RUN B" in text,
            "authorization boundary absent",
        )

    @case("25 pre-main SDK writes remain explicit")
    def _() -> None:
        text = (
            root / "docs/retroarch/phase-1.0d-startup-import-closure.md"
        ).read_text(encoding="utf-8")
        require(
            "__patch_init" in text and "not side-effect-free" in text,
            "pre-main effect hidden",
        )

    @case("26 static acceptance disclaimer exists")
    def _() -> None:
        text = (
            root / "docs/retroarch/phase-1.0d-loader-static-model.md"
        ).read_text(encoding="utf-8")
        require(
            "not proof" in text.lower() and "firmware" in text.lower(),
            "hardware disclaimer absent",
        )

    failures: list[str] = []
    for name, function in cases:
        try:
            function()
        except Exception as error:  # noqa: BLE001 - isolated test report
            failures.append(f"{name}: {error}")
    if len(cases) != 26:
        failures.append(f"expected 26 cases, found {len(cases)}")
    if failures:
        print("\n".join(failures), file=sys.stderr)
        return 1
    print("26 Phase 1.0D guardrails passed")
    return 0


if __name__ == "__main__":
    raise SystemExit(main())