#!/usr/bin/env python3
# SPDX-License-Identifier: GPL-3.0-or-later
"""Mutation guardrails for the inactive Phase-1.0T identity gate."""

from __future__ import annotations

import argparse
import importlib.util
from pathlib import Path
import sys


def load(path: Path):
    spec = importlib.util.spec_from_file_location("phase10t_validator", path)
    assert spec and spec.loader
    module = importlib.util.module_from_spec(spec)
    sys.modules[spec.name] = module
    spec.loader.exec_module(module)
    return module


def require(value: bool, message: str) -> None:
    if not value:
        raise RuntimeError(message)


def main() -> int:
    parser = argparse.ArgumentParser()
    parser.add_argument("--root", type=Path, required=True)
    args = parser.parse_args()
    root = args.root.resolve()
    validator = load(root / "tools/validate_retroarch_phase10t.py")
    record = validator.load_json(
        root / "manifests/retroarch/phase-1.0t-shsrv-identity-gate.json")
    cases = []

    def case(name):
        def register(function):
            cases.append((name, function))
            return function
        return register

    @case("01 all authorizations remain false")
    def _(): require(validator.all_false(record["authorizations"]), "authority active")

    @case("02 connection authorization is rejected")
    def _():
        value = dict(record["authorizations"]); value["ps5_connection_authorized"] = True
        require(not validator.all_false(value), "connection authority accepted")

    @case("03 automatic retry is rejected")
    def _():
        value = dict(record["authorizations"]); value["automatic_retry"] = True
        require(not validator.all_false(value), "retry accepted")

    @case("04 activation is inert")
    def _(): require(validator.activation_is_inactive(record["activation"]), "activation rejected")

    @case("05 target address activates and fails the gate")
    def _():
        value = dict(record["activation"]); value["target_address"] = "example.invalid"
        require(not validator.activation_is_inactive(value), "target accepted")

    @case("06 mandatory connection effects are complete")
    def _(): require(validator.connection_effects_are_complete(record["mandatory_connection_effects"]), "effects rejected")

    @case("07 serial transmission cannot be hidden")
    def _():
        value = dict(record["mandatory_connection_effects"]); value["serial_queried_and_transmitted"] = False
        require(not validator.connection_effects_are_complete(value), "serial effect hidden")

    @case("08 identity capability remains non-exact")
    def _(): require(validator.identity_is_non_exact(record["identity_capabilities"]), "identity rejected")

    @case("09 SHA-256 availability cannot be invented")
    def _():
        value = dict(record["identity_capabilities"]); value["sha256_command_available"] = True
        require(not validator.identity_is_non_exact(value), "SHA-256 invented")

    @case("10 help fingerprint never proves exact binary")
    def _(): require(all(not item["proves_exact_binary"] for item in record["command_fingerprints"].values()), "fingerprint promoted")

    @case("11 command policy is fail closed")
    def _(): require(validator.command_policy_is_fail_closed(record["command_policy"]), "policy rejected")

    @case("12 hbldr remains forbidden")
    def _(): require("hbldr" in record["command_policy"]["forbidden_mutating_or_launch_commands"], "hbldr allowed")

    @case("13 wildcard paths remain forbidden")
    def _(): require(record["command_policy"]["wildcards_allowed"] is False, "wildcard allowed")

    @case("14 sanitization is strict")
    def _(): require(validator.sanitization_is_strict(record["sanitization"]), "sanitization rejected")

    @case("15 raw transcript persistence fails")
    def _():
        value = dict(record["sanitization"]); value["raw_transcript_persistence_allowed"] = True
        require(not validator.sanitization_is_strict(value), "raw transcript accepted")

    @case("16 all future windows remain inactive")
    def _(): require(validator.future_windows_are_inactive(record["future_windows"]), "window active")

    @case("17 decision remains inactive")
    def _(): require(validator.decision_is_inactive(record["decision"]), "decision rejected")

    @case("18 no network client exists")
    def _(): require(record["decision"]["network_client_created"] is False, "client created")

    @case("19 no target or device action occurred")
    def _(): require(all(value is False for value in record["performed_actions"].values()), "action occurred")

    @case("20 host tests are not hardware proof")
    def _(): require(record["tests"]["hardware_claim_from_host_test"] is False, "host result promoted")

    failures = []
    for name, function in cases:
        try:
            function()
            print(f"PASS {name}")
        except Exception as error:  # noqa: BLE001 - mutation harness
            failures.append(f"{name}: {error}")
            print(f"FAIL {name}: {error}")
    if failures:
        return 1
    print(f"Phase-1.0T guardrails passed: {len(cases)}")
    return 0


if __name__ == "__main__":
    raise SystemExit(main())