"""Exclusive finite engineering seal; never creates a learned candidate.

Run only after independent numerical/budget reports and a NEW integrity process.
Report hashes are external arguments. Historical regression evidence is preserved,
not relabeled as a newly executed five-trial numerical regression.
"""
from __future__ import annotations

import argparse
import hashlib
import json
from pathlib import Path
import subprocess
import sys
from types import ModuleType

import execution_authority as A
from prepare_execution import ROOT, EXP, MODEL, save, verify

HELPER = ROOT/'models/male-cns-lif/pn-recruitment-audit-v1/publication.py'
HELPER_SHA = '7a79c499098b74163e7bb16adabcbc54e7069dafa204d0b99c7f4c03d79f8016'
require, read, digest = A.require, A.read, A.digest


def helper():
    raw = HELPER.read_bytes()
    require(hashlib.sha256(raw).hexdigest() == HELPER_SHA, 'Frozen seal verifier changed')
    module = ModuleType('_execution_seal_pure_verifier')
    module.__file__ = str(HELPER)
    exec(compile(raw, str(HELPER), 'exec'), module.__dict__)
    return module


def seal(directory):
    directory = Path(directory)
    require(directory.is_absolute() and directory.is_dir(), 'Exact real seal root required')
    require(not any((directory/n).exists() for n in ('manifest.json', 'checksums.sha256')), 'Never replace seal controls')
    paths = sorted(directory.rglob('*'))
    require(all(not p.is_symlink() and not (hasattr(p, 'is_junction') and p.is_junction()) and
                '__pycache__' not in p.parts and (p.is_file() or p.is_dir()) for p in (directory, *paths)),
            'Unsafe seal payload')
    files = [dict(path=p.relative_to(directory).as_posix(), bytes=p.stat().st_size, sha256=digest(p))
             for p in paths if p.is_file()]
    require(files, 'Empty seal forbidden')
    save(directory/'manifest.json', dict(root=str(directory), files=files))
    with (directory/'checksums.sha256').open('x', encoding='utf-8', newline='\n') as out:
        for row in files:
            out.write(row['sha256']+'  '+row['path']+'\n')
        out.write(digest(directory/'manifest.json')+'  manifest.json\n')
    return helper().verify_seal(directory)


def finalize(reg_sha, numerical_sha, budget_sha, integrity_sha):
    require(sys.dont_write_bytecode and 'torch' not in sys.modules, 'Fresh CPU -B process required')
    require(not any((EXP/n).exists() for n in ('audit/final-status.json', 'manifest.json', 'checksums.sha256', 'audit/stopped.json')),
            'Stopped, finalized or partly sealed workflow requires a separate explicit failure audit')
    reg_path = EXP/'protocol/preregistered.json'
    require(digest(reg_path) == reg_sha, 'External registration changed')
    reg = read(reg_path)
    require(reg['schema'] == 'conditioning-execution-registration-v1' and reg['engineering_only'] is True and
            reg['scientific_acquisition_authorized'] is False, 'Wrong scope')
    verify({**reg['source_sha256'], **reg['input_sha256'], **reg['prepared_file_sha256']})
    reports = {}
    for key, relative, sha in (
        ('numerical', 'audit/numerical-comparison.json', numerical_sha),
        ('budget', 'audit/budget-report.json', budget_sha),
        ('integrity', 'regression/integrity-after.json', integrity_sha)):
        path = EXP/relative
        require(A.pin(path)['sha256'] == sha, 'External '+key+' report changed')
        reports[key] = read(path)
    numerical, budget, integrity = (reports[n] for n in ('numerical', 'budget', 'integrity'))
    require(numerical['schema'] == 'conditioning-execution-numerical-audit-v1' and numerical['complete'] is True and
            numerical['registration_sha256'] == reg_sha and numerical['actual_new_brain_calls'] == 23 and
            numerical['actual_processes'] == 31 and numerical['actual_new_brain_ticks'] == 125200 and
            numerical['learning_pass_claimed'] is numerical['candidate_generated'] is False, 'Wrong numerical coverage/scope')
    status = numerical['status']
    require(status in ('PASS-EXACT-UPDATED-BOUNDARY-ENGINEERING-NOT-LEARNING',
                       'FAIL-NUMERICAL-OR-LINEAGE', 'INCOMPLETE-CHANGED-EDGE-COVERAGE'), 'Unknown engineering outcome')
    require(numerical['pass_all'] == status.startswith('PASS-'), 'Inconsistent engineering gate')
    require(budget['registration_sha256'] == reg_sha and budget['learning_pass_claimed'] is False,
            'Wrong budget authority or scientific overclaim')
    require(integrity['complete'] is True and integrity['AP']['pass_all'] is True and
            integrity['old_experiments_reexecuted'] is integrity['old_files_modified'] is False and
            integrity['five_frozen_reference_trials_rerun_here'] is integrity['scientific_learning_pass_claimed'] is False,
            'Historical integrity/scope not verified')
    # Recheck the actual file-bound evidence at sealing, not only old PASS flags.
    import audit_execution
    import budget_report
    require(audit_execution.same_json(audit_execution.audit(reg_sha, save_report=False), numerical),
            'Numerical evidence changed after the independent audit')
    require(audit_execution.same_json(budget_report.report(reg_sha, save_report=False), budget),
            'Budget evidence changed after the independent audit')
    # Historical integrity has a different frozen runtime import owner; isolate it.
    seal_integrity = EXP/'regression/integrity-at-seal.json'
    require(not seal_integrity.exists(), 'No automatic retry of partly completed finalization')
    command = [sys.executable, '-B', str(MODEL/'prepare_execution.py'), 'integrity', '--output', str(seal_integrity)]
    result = subprocess.run(command, cwd=MODEL, capture_output=True, text=True, timeout=1800)
    require(result.returncode == 0 and seal_integrity.is_file(),
            'Independent integrity-at-seal process failed: '+result.stderr[-2000:])
    require(audit_execution.same_json(read(seal_integrity), integrity), 'Frozen integrity changed before sealing')
    final = dict(schema='conditioning-execution-final-v1', status=status, registration_sha256=reg_sha,
        numerical_sha256=numerical_sha, budget_sha256=budget_sha, integrity_after_sha256=integrity_sha,
        integrity_at_seal_sha256=digest(seal_integrity), numerical_and_budget_recomputed_at_seal=True,
        actual_new_brain_calls=23, actual_new_brain_ticks=125200, actual_execution_child_processes=31,
        historical_integrity_after_pass=True, historical_five_trial_regression='AM sealed evidence preserved; not rerun here',
        scientific_acquisition_executed=False, scientific_acquisition_authorized=False,
        candidate_generated=False, learning_pass_claimed=False,
        source_code_commit=reg['source_code_commit'], entire_model_directory_sealed=False,
        source_scope='All registered source bytes and committed snapshot frozen by this experiment seal',
        bulk_data_git_backup_claimed=False)
    save(EXP/'audit/final-status.json', final)
    checked = seal(EXP)
    return dict(status=status, manifest_sha256=checked['manifest_sha256'], checksums_sha256=checked['checksums_sha256'],
                final_sha256=digest(EXP/'audit/final-status.json'), payload_files=checked['payload_file_count'],
                payload_bytes=checked['payload_bytes'], learning_pass_claimed=False)


if __name__ == '__main__':
    parser = argparse.ArgumentParser(description=__doc__)
    for name in ('registration', 'numerical', 'budget', 'integrity'):
        parser.add_argument('--'+name+'-sha256', required=True)
    args = parser.parse_args()
    print(json.dumps(finalize(args.registration_sha256, args.numerical_sha256, args.budget_sha256,
                              args.integrity_sha256), sort_keys=True), flush=True)