"""Read-only actual boundary-cost accounting; never authorizes normal training.

Only the two registered fresh/light performance cycles are cost samples. Their
next serial cycle start is a measured conservative tail-completion upper bound,
not an invented postvalidation duration. All current compiled-cache bytes are
charged to EACH sample (deliberate overcount); cache reuse is never free by fiat.
No normal directory-hashing/finalization policy or reserves are registered yet,
so the strict full-suite forecast remains INSUFFICIENT-MEASUREMENTS. This report
does not independently re-observe historical OS exits or certify learning.
"""
from __future__ import annotations

from copy import deepcopy
import hashlib
import json
import math
from pathlib import Path

import execution_authority as A
import execution_budget as B
import execution_workflow as F


SCHEMA = 'conditioning-actual-budget-report-v1'
TRAIN = 'performance--natural-light-fresh'
PROBE = 'performance--evaluation-A-light-fresh'
SELECTED = {TRAIN: [('brain',TRAIN),('original_E',TRAIN+'--original-E'),('cpu_validator',TRAIN+'--cpu-verify')],
            PROBE: [('brain',PROBE)]}
POLICY = 'measured-fresh-light-1200-fullgraph-with-original-E-and-CPU-verification-for-training'
require = A.require


def _canonical(value):
    return json.dumps(value,sort_keys=True,separators=(',', ':'),ensure_ascii=False,allow_nan=False)


def _sha(value):
    return hashlib.sha256(_canonical(value).encode()).hexdigest()


def _same(a,b):
    return _canonical(a)==_canonical(b)


def _number(value):
    return type(value) in (int,float) and math.isfinite(value) and value>=0


class Evidence:
    def __init__(self):
        self.pins={}
        self.derived={}

    def pin(self,path,expected=None):
        if not Path(path).exists():
            raise FileNotFoundError(2,'Missing measurement evidence',str(path))
        entry=A.pin(path);p=entry['path'];sha=entry['sha256']
        require(expected is None or sha==expected,'Evidence bytes changed: '+p)
        require(p not in self.pins or self.pins[p]==sha,'Conflicting evidence pin: '+p)
        self.pins[p]=sha
        return dict(receipt_id=p,sha256=sha)

    def read(self,path,expected=None):
        self.pin(path,expected)
        return A.read(path)

    def inventory(self,directory):
        result=F.tree(directory)
        for name,row in result.items():self.pin(Path(directory)/name,row['sha256'])
        return result

    def derived_binding(self,name,value):
        key='derived:'+name
        self.derived[key]=deepcopy(value)
        return dict(receipt_id=key,sha256=_sha(value))

    def authenticated(self):
        return {**self.pins,**{key:_sha(value) for key,value in self.derived.items()}}


def _parent_process(name,reg,reg_sha,evidence):
    exp=F.EXP;process_path=exp/'receipts'/f'{name}.process.json'
    process=evidence.read(process_path)
    require(process['schema']=='conditioning-execution-process-v1' and process['complete'] is True and
        process['name']==name and process['registration_sha256']==reg_sha and
        type(process['exit_code']) is int and process['exit_code']==0 and process['timed_out'] is False,
        'Unsuccessful/unbound parent process: '+name)
    jobpath=exp/'jobs'/f'{name}.json';job=evidence.read(jobpath,process['job_sha256'])
    workerpath=exp/'receipts'/f'{name}.worker.json'
    worker=evidence.read(workerpath,process['worker_receipt_sha256'])
    ap=job['kind'] in ('brain','update');script=F.AP_WORKER if ap else F.MODEL/'isolated_execution.py'
    schema='phase4ap-isolated-worker-receipt-v1' if ap else 'conditioning-isolated-execution-receipt-v1'
    worker_sha=F.W.AP_SHA if ap else reg['source_sha256'][str(script)]
    require(worker['schema']==schema and worker['complete'] is True and job['worker_sha256']==worker_sha and
        all(worker[k]==job[k] for k in ('job_id','kind','registration_sha256','worker_sha256')) and
        job['job_id']==name and job['kind']==process['kind'] and job['registration_sha256']==reg_sha and
        worker['job_sha256']==process['job_sha256'] and job['receipt_file']==str(workerpath),
        'Worker/job/parent receipt identity differs')
    expected={**job['input_sha256'],str(jobpath):process['job_sha256'],str(script):worker_sha}
    if ap:expected.update({v['path']:v['sha256'] for v in job['sources'].values()})
    else:
        expected[str(F.AP_WORKER)]=F.W.AP_SHA
        expected.update({str(F.MODEL/n):s for n,s in job['source_sha256'].items()})
    require(expected.get(str(exp/'protocol/preregistered.json'))==reg_sha and
        worker['verified_input_sha256' if ap else 'input_sha256']==expected,'Actual input/source closure differs')
    for path,sha in expected.items():evidence.pin(path,sha)
    command=process['argv']
    require(type(command) is list and len(command)>3 and command[1:3]==['-B',str(script)] and
        command[3:]==(['brain' if job['kind']=='brain' else 'update'] if ap else [])+
        ['--job',str(jobpath),'--job-sha256',process['job_sha256']], 'Observed child command differs')
    for side in ('stdout','stderr'):evidence.pin(exp/'logs'/f'{name}.{side}.log',process[side+'_sha256'])
    evidence.pin(str(workerpath)+'.attempt.json',worker['attempt_sha256'])
    output=Path(job['output_dir'])
    require(output.is_relative_to(exp) and worker['output_dir']==str(output),'Wrong child output root')
    inventory=evidence.inventory(output);hashes={k:v['sha256'] for k,v in inventory.items()}
    require(inventory and hashes==worker['output_files_sha256'] and
        process['output_bytes']==sum(v['bytes'] for v in inventory.values()) and
        process['output_inventory_sha256']==hashlib.sha256(json.dumps(hashes,sort_keys=True).encode()).hexdigest(),
        'Actual complete child output inventory differs')
    start,exit_,end=(process[k] for k in ('spawn_monotonic','exit_monotonic','validation_end_monotonic'))
    require(all(_number(v) for v in (start,exit_,end)) and start<exit_<=end and
        math.isclose(process['child_wall_seconds'],exit_-start,rel_tol=1e-12) and
        math.isclose(process['end_to_end_seconds'],end-start,rel_tol=1e-12) and
        math.isclose(process['validation_wall_seconds'],end-exit_,rel_tol=1e-12),'Parent timing layers differ')
    return dict(process=process,job=job,worker=worker,output_inventory=inventory,
                binding=evidence.pin(process_path))


def _cycle_files(name,events,evidence):
    """Exact newly generated scope of the frozen workflow performance branches."""
    paths=set()
    for row in events:
        job=row['job'];event=job['job_id'];output=Path(job['output_dir'])
        paths.update(output/key for key in row['output_inventory'])
        paths.update(F.EXP/f'{directory}/{event}{suffix}' for directory,suffix in
            (('jobs','.json'),('receipts','.worker.json'),('receipts','.worker.json.attempt.json'),
             ('receipts','.process.json'),('logs','.stdout.log'),('logs','.stderr.log')))
    brain=events[0]['job'];case=Path(brain['case_dir'])
    require(case==F.EXP/'cases'/name,'Performance case must be separate, not a continuation/shared case')
    paths.update(case/n for n in ('spec.json','requests.npz'))
    if name==TRAIN:paths.add(F.EXP/'authorities'/f'{name}.epoch.json')
    result={}
    for path in paths:
        entry=evidence.pin(path)
        result[path.relative_to(F.EXP).as_posix()]=dict(sha256=entry['sha256'],bytes=path.stat().st_size)
    return result


def _collect(reg,reg_sha,evidence):
    complete=evidence.read(F.EXP/'audit/execution-complete.json')
    calls=reg['plan']['calls'];ordered=[c['call_id'] for c in calls]
    require(complete['complete'] is True and complete['registration_sha256']==reg_sha and
        complete['scientific_learning_pass_claimed'] is False and complete['completed_calls']==ordered,
        'Actual complete fixed workflow required')
    names=set(ordered)|{'evaluation-inputs','AP-D1--cpu-verify','AP-D0--cpu-verify','AP-frozen--cpu-verify'}
    names|={base+suffix for base in (TRAIN,'mechanical--fresh-parent') for suffix in ('--original-E','--cpu-verify')}
    require(set(complete['processes'])==names and len(names)==reg['plan']['counts']['total_children'],
        'Actual finite process inventory differs')
    for name,path in complete['processes'].items():
        require(Path(path)==F.EXP/'receipts'/f'{name}.process.json','Unexpected process receipt location')
    processes={name:_parent_process(name,reg,reg_sha,evidence) for name in sorted(names)}
    attempt=evidence.read(F.EXP/'audit/execution-attempt.json')
    require(attempt['registration_sha256']==reg_sha and _number(attempt['monotonic_origin']), 'Missing parent clock origin')
    cycles={name:evidence.read(F.EXP/'receipts'/f'{name}.cycle.json') for name in ordered}
    for call in calls:
        cycle=cycles[call['call_id']]
        require(cycle['complete'] is True and cycle['learning_pass_claimed'] is False and
            cycle['source_registration_sha256']==reg_sha and _same(cycle['call'],call), 'Cycle/registration binding differs')
    final_build=evidence.inventory(F.EXP/'extension-build')
    require(_same(cycles[ordered[-1]]['mutable_build_inventory_after'],final_build), 'Final mutable cache inventory changed')
    build_bytes=sum(v['bytes'] for v in final_build.values())
    samples=[];accounts={};contexts=[]
    for name,roles in SELECTED.items():
        cycle=cycles[name];next_name=ordered[ordered.index(name)+1];tail_end=cycles[next_name]['start_monotonic']
        start,end=cycle['start_monotonic'],cycle['end_monotonic']
        require(all(_number(v) for v in (start,end,tail_end)) and attempt['monotonic_origin']<=start<end<=tail_end and
            math.isclose(cycle['wall_seconds'],end-start,rel_tol=1e-12),'Missing ordered adjacent-cycle tail bound')
        rows=[processes[n] for _,n in roles];brain=rows[0];job=brain['job']
        require(job['kind']=='brain' and job['diagnostic_mode']=='light','Only complete fresh light brain samples')
        summary=evidence.read(Path(job['output_dir'])/'summary.json')
        expected=dict(steps=1200,completed_ticks=1200,explicit_steps_executed=1200,max_steps=1200,nodes=B.N,edges=B.E,
            diagnostic_mode='light',entire_neural_trial_executed=True,within_trial_weight_updates=False,
            precision='float64',apl_precision='float32')
        require(all(_same(summary.get(k),v) for k,v in expected.items()) and
            brain['worker']['result']['complete_fresh_trial'] is True, 'Incomplete/different fresh neural trial')
        spec=evidence.read(Path(job['case_dir'])/'spec.json')
        require(spec['dt_ms']==.1 and spec['steps']==1200 and
            'parent_checkpoint_manifest_sha256' not in spec and 'global_tick_offset' not in spec,
            'Continuation or changed clock cannot estimate fresh normal costs')
        if name==TRAIN:
            epoch=evidence.read(rows[1]['job']['authority_file']);cpu=rows[2]['job']
            require(rows[1]['job']['kind']=='update' and cpu['kind']=='validate_cpu' and
                cpu['authority_file']==rows[1]['job']['authority_file'] and cpu['update_dir']==rows[1]['job']['output_dir'] and
                epoch['checkpoint_dir']==job['output_dir'] and epoch['command']==dict(steps=1200,compartment="y5B'2a",
                    us_tick=900,d_command=1.,frozen=False,trace_backend='torch'), 'Training cycle E/CPU parts differ')
        else:
            call=cycle['call']
            require(call['US'] is False and call['plastic_update'] is False and call['parent'] is None and
                job['overlay_file']==reg['initial_overlay']['overlay_file'], 'Fresh probe must be zero-overlay no-US/no-update')
            sampler=processes['evaluation-inputs']['job']
            evidence.pin(Path(job['case_dir'])/'requests.npz',A.digest(Path(sampler['output_dir'])/'A-requests.npz'))
        context=dict(policy=POLICY,environment=brain['worker']['environment'],brain_sources=job['sources'],
            model={k:spec[k] for k in ('model','apl','dt_ms','precision','apl_precision','apl_delay_steps','graph_dir','apl_bundle_dir')},
            registered_sources_sha256=reg['source_sha256'],
            output_policy='retain_all_cycle_artifacts_plus_entire_final_cache_each_cycle; no amortization')
        contexts.append(context)
        observed=_cycle_files(name,rows,evidence)
        require(_same(cycle['output_inventory'],observed) and cycle['output_bytes']==sum(v['bytes'] for v in observed.values()),
            'Cycle created inventory is not actual complete fixed-branch scope')
        own=F.EXP/'receipts'/f'{name}.cycle.json';own_bytes=own.stat().st_size
        inventory=dict(created=observed,cycle_receipt=evidence.pin(own),cycle_receipt_bytes=own_bytes,
            full_current_build_cache=final_build,full_current_build_cache_bytes=build_bytes,
            total_bytes=cycle['output_bytes']+own_bytes+build_bytes)
        events=[]
        for (role,event_name),row in zip(roles,rows):
            p=row['process'];runtime=row['worker'].get('wall_seconds')
            require(_number(runtime) and runtime<=p['child_wall_seconds'],'Worker runtime duration missing/inconsistent')
            require(start<=p['spawn_monotonic'] and p['validation_end_monotonic']<=end,'Process outside actual cycle clock')
            events.append(dict(event_id=event_name,role=role,receipt_kind='parent-process',receipt=row['binding'],
                spawn_s=p['spawn_monotonic'],exit_s=p['exit_monotonic'],validated_s=p['validation_end_monotonic'],
                exit_code=0,core_seconds=None,runtime_seconds=runtime,child_wall_seconds=p['child_wall_seconds']))
        samples.append(dict(schema=B.SCHEMA,cycle_id=name,kind='training' if name==TRAIN else 'probe',
            diagnostic_mode='light',steps=1200,neurons=B.N,edges=B.E,dt_ms=.1,context_sha256=_sha(context),
            clock_id='registered-parent:'+reg_sha,started_s=start,validated_s=tail_end,
            authority=evidence.pin(own),events=events,outputs=dict(inventory=evidence.derived_binding(name,inventory),
                scope=B.OUTPUT_SCOPE,complete=True,total_bytes=inventory['total_bytes']),complete=True))
        accounts[name]=dict(recorded_cycle_seconds=end-start,tail_upper_bound_seconds=tail_end-end,
            conservative_complete_cycle_seconds=tail_end-start,tail_bound_from_next_cycle=next_name,
            tail_may_include_intervening_sampler=True,created_bytes=cycle['output_bytes'],cycle_receipt_bytes=own_bytes,
            repeated_full_cache_bytes=build_bytes,total_conservative_bytes=inventory['total_bytes'],
            core_timing=None,core_timing_reason='no unrounded authenticated core timing contract; never substituted for wall')
    require(_same(contexts[0],contexts[1]),'Train/probe machine/code/model/output policies differ')
    return samples,accounts,contexts[0]


def report(reg_sha,save_report=True):
    """Verify current bytes; optionally exclusively save audit/budget-report.json.

    Missing evidence returns INSUFFICIENT; contradictory/tampered evidence raises.
    No full-suite numerical estimate is admitted without a future registered
    normal executor, growing-inventory hash policy and explicit complete reserves.
    """
    require(type(save_report) is bool,'save_report must be Boolean')
    destination=F.EXP/'audit/budget-report.json'
    require(not save_report or not destination.exists(),'Budget report exists; never overwrite')
    reg=F.registration(reg_sha);evidence=Evidence();evidence.pin(F.EXP/'protocol/preregistered.json',reg_sha)
    samples=[];accounting={};context=None;missing=[]
    try:samples,accounting,context=_collect(reg,reg_sha,evidence)
    except FileNotFoundError as error:missing.append('Actual measurement evidence missing: '+str(error.filename))
    measured=[];used=set()
    for row in samples:measured.append(B._measure(row,evidence.authenticated(),used))
    # These explicit placeholders are supplied ONLY with zero admitted samples.
    # They are not assumptions of zero future cost and can never yield a total.
    blocked_reserves={role:dict(wall_seconds=0,output_bytes=0,basis='UNREGISTERED; not used for a projection') for role in B.RESERVE_ROLES}
    blocked_reserves['cycle_multiplier']=1
    projection=B.estimate_normal_suite([],authenticated_receipts={},target_context_sha256=reg_sha,
        reserves=blocked_reserves,limits=None)
    missing+=['FUTURE-POLICY-NOT-REGISTERED: normal executor/context and growing-output hashing/finalization policy',
              'FUTURE-POLICY-NOT-REGISTERED: explicit sampler/input, parent hash, final integrity, compiler/warmup and unknown-activity reserves',
              'FUTURE-POLICY-NOT-REGISTERED: normal wall/storage caps; engineering 4 GiB/7200 s is not a normal budget']
    value=dict(schema=SCHEMA,registration_sha256=reg_sha,status='INSUFFICIENT-MEASUREMENTS',
        policy_status='FUTURE-POLICY-NOT-REGISTERED',inventory=deepcopy(B.INVENTORY),measurements=measured,
        available_cost_cycles=samples,accounting=accounting,measured_context=context,
        measured_context_sha256=None if context is None else _sha(context),strict_projection=projection,
        estimated_wall_seconds=None,estimated_output_bytes=None,missing=missing,
        evidence_sha256=evidence.pins,derived_inventories=evidence.derived,
        verification_scope='registered parent receipts plus actual current bytes; historical OS exits are not re-observed',
        limitations=['only two fixed fresh light samples; no fitting, reference-to-light substitution or continuation extrapolation',
            'adjacent-cycle tail is a measured upper bound and may conservatively count intervening sampler work',
            'full final mutable cache is charged repeatedly for storage; compile/warmup wall for future policy remains unknown',
            'no assumption that activity/output volume remains constant after learning; no guaranteed full-suite bound',
            'shared registration/input preparation, final integrity and report own-file costs are not cycle costs'],
        engineering_scope=True,learning_pass_claimed=False,execution_authorized=False,
        assumptions_registered=False,normal_budget_authorized=False,no_new_brain_calls=True)
    F.verify(evidence.pins)
    if save_report:F.save(destination,value)
    return value