#!/usr/bin/env python3
"""Read-only frozen-integrity verification and final Phase 4P sealing."""
from __future__ import annotations

import hashlib
import json
import shutil
import time
from pathlib import Path

import yaml

import phase4p_validate
from phase4h_audit import verify_checksum
from phase4k import dataset_checks
from phase4m import frozen_checks, frozen_hashes
from phase4n import load_config


ROOT = Path("/data/digital-drosophila")


def save(path: Path, value: object) -> None:
    path.parent.mkdir(parents=True, exist_ok=True)
    path.write_text(json.dumps(value, indent=2, sort_keys=True, default=str) + "\n")


def read(path: Path): return json.loads(path.read_text())


def integrity() -> dict:
    ncfg, mcfg, cfg, _ = load_config(ROOT / "models/male-cns-lif/credit-assignment-v1/phase4n.yaml")
    checks = {}
    for label, root, rel in [
        ("Phase4M experiment", Path(mcfg["experiment_root"]), "manifests/checksums.sha256"),
        ("Phase4M model", Path(mcfg["model_root"]), "checksums.sha256"),
        ("Phase4N experiment", Path(ncfg["experiment_root"]), "manifests/checksums.sha256"),
        ("Phase4N model", Path(ncfg["model_root"]), "checksums.sha256")]:
        checks[label] = verify_checksum(root, root / rel)
    earlier = frozen_checks(cfg); datasets = dataset_checks(cfg); current = frozen_hashes(cfg)
    saved = read(Path(mcfg["experiment_root"]) / "audit/final-summary.json")["integrity"]["after"]
    phase4o = verify_checksum(ROOT / "experiments/phase4o-runtime-credit",
                              ROOT / "experiments/phase4o-runtime-credit/manifests/checksums.sha256")
    report = {"Phase1_to_3B": datasets, "Phase4C_to_4L": earlier, "Phase4M_4N": checks,
              "Phase4O": phase4o, "frozen_input_hashes_unchanged": current == saved}
    report["all_static_checks_passed"] = bool(datasets["all_passed"] and earlier["all_passed"] and
        all(x["passed"] for x in checks.values()) and phase4o["passed"] and current == saved)
    return report


def seal_dir(root: Path, control: Path) -> int:
    rows = []
    for p in sorted(root.rglob("*")):
        if p.is_file() and p != control and p.name not in ("checksums.sha256", "MANIFEST.json"):
            h = hashlib.sha256()
            with p.open("rb") as f:
                for chunk in iter(lambda: f.read(8 << 20), b""): h.update(chunk)
            rows.append((h.hexdigest(), p.relative_to(root).as_posix(), p.stat().st_size))
    control.parent.mkdir(parents=True, exist_ok=True)
    control.write_text("".join(f"{h}  {rel}\n" for h, rel, _ in rows))
    save(control.parent / "MANIFEST.json", {"root": str(root), "files": [{"path": r, "sha256": h, "size": s} for h, r, s in rows]})
    return len(rows)


def main() -> None:
    cfg = yaml.safe_load((ROOT / "models/male-cns-lif/deterministic-runtime-v2/phase4p.yaml").read_text())
    exp = Path(cfg["paths"]["experiment_root"]); model = Path(cfg["paths"]["model_root"])
    frozen = integrity(); save(exp / "audit/frozen-integrity-final.json", frozen)
    gate = read(exp / "audit/candidate-gate.json"); p4c = read(exp / "phase4c-v2/summary.json")
    reval = read(exp / "revalidation/summary.json"); threshold = read(exp / "threshold-3942/summary.json")
    fanout = read(exp / "fanout-tests/summary.json"); history = read(exp / "historical-comparison/summary.json")
    brainio = read(exp / "brainio/summary.json"); activity = read(exp / "activity-stream/summary.json")
    eligibility = read(exp / "eligibility-replay/summary.json")
    performance = read(exp / "performance/instrumented-100ms.json")
    highest = reval["highest_revalidated"]
    final = {"phase": "4P", "status": gate["status"], "candidate_generated": gate["candidate_generated"],
             "numerical_contract": "MaleCNS-NumericalContract-v1", "canonical_order": ["target_idx", "source_idx", "edge_id"],
             "neuron_3942": threshold, "real_fanout": fanout, "phase4c_5x20": p4c,
             "historical_comparison": history, "BrainIO": brainio, "ActivityStream": activity,
             "eligibility_fixed_event_replay": eligibility, "performance": performance, "candidate_gates": gate["gates"],
             "revalidation": reval, "highest_revalidated": highest,
             "frozen_integrity": frozen, "prohibited_follow_on_started": False,
             "limitations": [
                 "Canonical stable sorting plus one-thread-per-target reduction is correctness-first and 2.6-5.0x slower than biological real time for the 1 s trials.",
                 "Historical runtime-v1 full population/state distributions were not persisted for all 50 Phase4O repeats; total-spike envelopes use all runs while population/V/g comparisons use the frozen historical reference.",
                 "The compiler emitted a generic c++ versus g++ warning even though the cached extension loaded and all exact regressions passed."]}
    save(exp / "audit/final-summary.json", final)
    candidate = model / "candidate"; shutil.copy2(model / "phase4p_revalidate.py", candidate / "phase4p_revalidate.py")
    shutil.copy2(model / "phase4p_finalize.py", candidate / "phase4p_finalize.py")
    shutil.copy2(model / "phase4p_benchmark.py", candidate / "phase4p_benchmark.py")
    save(candidate / "VERSION.json", {"name": gate["status"], "numerical_contract": "MaleCNS-NumericalContract-v1",
         "revalidated_through": highest, "generated_utc": time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime()),
         "biological_parameters_changed": False, "historical_references_overwritten": False})
    candidate_files = seal_dir(candidate, candidate / "checksums.sha256")
    phase4p_validate.make_manifest(cfg, final)
    own = verify_checksum(candidate, candidate / "checksums.sha256")
    print(json.dumps({"status": final["status"], "highest_revalidated": highest,
                      "frozen_integrity": frozen["all_static_checks_passed"],
                      "candidate_files": candidate_files, "candidate_checksum": own["passed"]}, indent=2), flush=True)


if __name__ == "__main__": main()