#!/usr/bin/env python3
# SPDX-License-Identifier: GPL-3.0-or-later
"""Mutation guardrails for the inactive Phase-1.0K runner record."""

from __future__ import annotations

import argparse
import copy
import importlib.util
from pathlib import Path
import sys


def load(path: Path):
    spec = importlib.util.spec_from_file_location("phase10k", path)
    assert spec and spec.loader
    module = importlib.util.module_from_spec(spec)
    sys.modules[spec.name] = module
    spec.loader.exec_module(module)
    return module


def require(value: bool, message: str) -> None:
    if not value:
        raise RuntimeError(message)


def main() -> int:
    parser = argparse.ArgumentParser()
    parser.add_argument("--root", type=Path, required=True)
    args = parser.parse_args()
    root = args.root.resolve()
    validator = load(root / "tools/validate_retroarch_phase10k.py")
    record = validator.load_json(root / "manifests/retroarch/phase-1.0k-write-diag-one-shot-runner.json")
    approval = validator.load_json(root / "manifests/retroarch/phase-1.0k-one-shot-approval-template.json")
    cases = []

    def case(name):
        def register(function):
            cases.append((name, function))
            return function
        return register

    @case("01 all authorizations remain false")
    def _(): require(validator.all_false(record["authorizations"], validator.AUTHORIZATION_FIELDS), "authorization active")

    @case("02 connection authorization fails")
    def _():
        value = dict(record["authorizations"]); value["ps5_connection_authorized"] = True
        require(not validator.all_false(value, validator.AUTHORIZATION_FIELDS), "connection accepted")

    @case("03 no target or device action occurred")
    def _(): require(validator.all_false(record["phase_actions"], validator.ACTION_FIELDS), "action recorded")

    @case("04 artifact remains ineligible")
    def _(): require(validator.artifact_is_ineligible(record["artifact"]), "artifact rejected")

    @case("05 execution eligibility fails")
    def _():
        value = dict(record["artifact"]); value["execution_eligible"] = True
        require(not validator.artifact_is_ineligible(value), "eligible artifact accepted")

    @case("06 changed artifact hash fails")
    def _():
        value = dict(record["artifact"]); value["sha256"] = "0" * 64
        require(not validator.artifact_is_ineligible(value), "changed hash accepted")

    @case("07 wire table is exact and inactive")
    def _(): require(validator.protocol_is_exact_and_inactive(record["result_protocol"]), "protocol rejected")

    @case("08 alphabetical D13 placement fails")
    def _():
        value = copy.deepcopy(record["result_protocol"]); value["wire_stages"][-2:] = ["D13", "C1"]
        require(not validator.protocol_is_exact_and_inactive(value), "wrong table accepted")

    @case("09 D13 index mutation fails")
    def _():
        value = dict(record["result_protocol"]); value["d13_wire_index"] = 13
        require(not validator.protocol_is_exact_and_inactive(value), "wrong D13 index accepted")

    @case("10 tracked target fails")
    def _():
        value = dict(record["result_protocol"]); value["tracked_target"] = "TEST-NET"
        require(not validator.protocol_is_exact_and_inactive(value), "tracked target accepted")

    @case("11 protocol activation fails")
    def _():
        value = dict(record["result_protocol"]); value["protocol_activation_authorized"] = True
        require(not validator.protocol_is_exact_and_inactive(value), "activation accepted")

    @case("12 runner is fail closed")
    def _(): require(validator.runner_is_fail_closed(record["runner"]), "runner rejected")

    @case("13 free protocol selector fails")
    def _():
        value = dict(record["runner"]); value["free_protocol_selector"] = True
        require(not validator.runner_is_fail_closed(value), "free selector accepted")

    @case("14 retry fails")
    def _():
        value = dict(record["runner"]); value["retry"] = True
        require(not validator.runner_is_fail_closed(value), "retry accepted")

    @case("15 multiple connections fail")
    def _():
        value = dict(record["runner"]); value["maximum_connections"] = 2
        require(not validator.runner_is_fail_closed(value), "multiple connections accepted")

    @case("16 receipt after connect fails")
    def _():
        value = dict(record["runner"]); value["attempt_receipt_written_before_connect"] = False
        require(not validator.runner_is_fail_closed(value), "late receipt accepted")

    @case("17 approval template is inactive")
    def _(): require(validator.approval_is_inactive(approval), "approval rejected")

    @case("18 activated approval fails")
    def _():
        value = dict(approval); value["authorized"] = True
        require(not validator.approval_is_inactive(value), "active approval accepted")

    @case("19 nonzero action counts fail")
    def _():
        value = dict(approval); value["execution_count"] = 1
        require(not validator.approval_is_inactive(value), "execution count accepted")

    @case("20 host tests are not hardware evidence")
    def _(): require(record["tests"]["hardware_evidence_from_phase10k"] is False, "hardware proof invented")

    failures = []
    for name, function in cases:
        try:
            function(); print(f"PASS {name}")
        except Exception as error:  # noqa: BLE001 - mutation harness
            failures.append(f"{name}: {error}"); print(f"FAIL {name}: {error}")
    if failures:
        return 1
    print(f"Phase-1.0K guardrails passed: {len(cases)}")
    return 0


if __name__ == "__main__":
    raise SystemExit(main())