#!/usr/bin/env python3
# SPDX-License-Identifier: GPL-3.0-or-later
"""Validate exact Phase-1.0AX host reference bindings."""

from __future__ import annotations

import argparse
import hashlib
import json
from pathlib import Path


def digest(path: Path) -> str:
    return hashlib.sha256(path.read_bytes()).hexdigest()


def main() -> int:
    parser = argparse.ArgumentParser()
    parser.add_argument("--root", type=Path, required=True)
    args = parser.parse_args()
    root = args.root
    path = root / "manifests/retroarch/phase-1.0ax-canary-protocol-model.json"
    data = json.loads(path.read_text(encoding="utf-8"))
    binding = data["source_bindings"]
    assert digest(root / "manifests/retroarch/phase-1.0aw-canary-source-delta-audit.json") == binding["phase10aw_manifest_sha256"]
    assert digest(root / "tools/phase10ax_canary_protocol_model.py") == binding["model_sha256"]
    assert digest(root / "tests/test_phase10ax_canary_protocol_model.py") == binding["tests_sha256"]
    assert data["frame_contract"]["only_d14_terminal"] is True
    assert data["frame_contract"]["d12_terminal_forbidden"] is True
    assert data["cleanup_terminal_contract"]["cleanup_failure_count_zero_required"] is True
    assert data["trace_contract"]["host_trace_means_firmware_behavior"] is False
    assert not any(data["authorizations"].values())
    assert data["decision"]["target_source_matches_model"] is False
    print("Phase-1.0AX canary protocol model validation passed")
    return 0


if __name__ == "__main__":
    raise SystemExit(main())