#!/usr/bin/env python3
"""Generate deterministic S2-04 blocked sim entrypoint batch evidence."""

from __future__ import annotations

import hashlib
import json
import subprocess
from pathlib import Path

ROOT = Path(__file__).resolve().parents[1]
OUTPUT = ROOT / "coverage/configuration-batch-s2.report.json"
INPUTS = (
    "context-lock.json",
    "coverage/configuration-regression.report.json",
    "coverage/full-configuration-startup-matrix.report.json",
    "web/workspace/configuration-batch.mjs",
    "web/workspace/configuration-startup.mjs",
    "web/workspace/resource-resolver.mjs",
    "web/worker/sim-session.mjs",
    "web/worker/test_configuration_batch.mjs",
)


def digest(data: bytes) -> str:
    return hashlib.sha256(data).hexdigest()


def canonical(value: object) -> bytes:
    return json.dumps(value, ensure_ascii=False, sort_keys=True, separators=(",", ":")).encode("utf-8")


def run(command: list[str]) -> dict[str, object]:
    result = subprocess.run(command, cwd=ROOT, text=True, capture_output=True, check=False)
    sample = None
    for line in reversed(result.stdout.splitlines()):
        if line.lstrip().startswith("{"):
            try:
                sample = json.loads(line)
                break
            except json.JSONDecodeError:
                continue
    return {"command": command, "returncode": result.returncode, "status": "verified" if result.returncode == 0 else "blocked", "stdout_sha256": digest(result.stdout.encode()), "stderr_sha256": digest(result.stderr.encode()), "sample": sample}


def generate(output: Path = OUTPUT) -> dict[str, object]:
    context = json.loads((ROOT / "context-lock.json").read_text(encoding="utf-8"))
    matrix = json.loads((ROOT / "coverage/full-configuration-startup-matrix.report.json").read_text(encoding="utf-8"))
    regression = json.loads((ROOT / "coverage/configuration-regression.report.json").read_text(encoding="utf-8"))
    worker = run(["node", "web/worker/test_configuration_batch.mjs"])
    sample = worker["sample"] or {}
    report: dict[str, object] = {
        "schema": "configuration-batch-s2-report.v1",
        "task_id": "S2-04",
        "context_id": context["context_id"],
        "status": "verified" if worker["status"] == "verified" and sample.get("status") == "verified" and sample.get("total") == 264 and sample.get("ready") == 56 and sample.get("blocked") == 208 else "blocked",
        "features": ["264 registered configuration entries", "233 entrypoint-compatible matrix preservation", "READY/BLOCKED terminal classification", "source/resource diagnostics retained", "duplicate/capacity/status/hash fail-closed validation", "Worker checkpoint state"],
        "counts": {"registered_entries": regression["counts"]["registered_configuration_entries"], "entrypoints": regression["counts"]["config_entrypoints"], "ready": matrix["counts"]["statuses"]["ready"], "blocked": matrix["counts"]["statuses"]["blocked"], "resource_rows": matrix["counts"]["resource_rows"]},
        "blocked_codes": {"resource_missing": 194, "resource_unindexed": 11, "kinematics_unregistered": 3},
        "boundaries": ["missing/unindexed/unsupported resources remain BLOCKED", "no basename substitution or host-path access", "release ownership and official oracle remain outside simulation task"],
        "inputs": [{"path": path, "sha256": digest((ROOT / path).read_bytes())} for path in INPUTS],
        "test": worker,
        "sample": sample,
        "report_sha256": None,
    }
    report["report_sha256"] = digest(canonical({key: value for key, value in report.items() if key != "report_sha256"}))
    output.parent.mkdir(parents=True, exist_ok=True)
    output.write_text(json.dumps(report, ensure_ascii=False, sort_keys=True, indent=2) + "\n", encoding="utf-8")
    return report


if __name__ == "__main__":
    report = generate()
    print(f"configuration_batch_s2={report['status']} entries={report['counts']['registered_entries']} blocked={report['counts']['blocked']}")