#!/usr/bin/env python3
"""Generate deterministic S6-06 Chromium profile restart evidence."""

from __future__ import annotations

import argparse
import hashlib
import json
import subprocess
from pathlib import Path
from typing import Any


CONTEXT_ID = "linuxcnc-2.10.0-pre0-wasm-m1-py-c1"
COMMAND = ("xvfb-run", "-a", "node", "scripts/test_browser_opfs_restart_s6_06.mjs")
INPUTS = (
    "context-lock.json",
    "coverage/authoritative-browser-s6-05.report.json",
    "web/workspace/opfs-runtime.mjs",
    "web/app/browser-opfs-probe.html",
    "web/app/browser-opfs-worker.mjs",
    "scripts/test_browser_opfs_restart_s6_06.mjs",
)


def canonical(value: Any) -> str:
    return json.dumps(value, ensure_ascii=False, sort_keys=True, separators=(",", ":"))


def digest(value: bytes) -> str:
    return hashlib.sha256(value).hexdigest()


def artifact(root: Path, path: str) -> dict[str, Any]:
    value = root / path
    if not value.is_file(): return {"path": path, "status": "missing"}
    return {"path": path, "bytes": value.stat().st_size, "sha256": digest(value.read_bytes())}


def run(root: Path) -> dict[str, Any]:
    result = subprocess.run(COMMAND, cwd=root, stdout=subprocess.PIPE, stderr=subprocess.PIPE, check=False)
    sample = None
    for line in reversed(result.stdout.decode("utf-8", errors="replace").splitlines()):
        if line.lstrip().startswith("{"):
            try: sample = json.loads(line); break
            except json.JSONDecodeError: continue
    return {"command": list(COMMAND), "returncode": result.returncode, "status": "PASSED" if result.returncode == 0 else "FAILED", "stdout_sha256": digest(result.stdout), "stderr_sha256": digest(result.stderr), "sample": sample}


def generate(root: Path, output: Path) -> dict[str, Any]:
    root = root.resolve()
    runs = [run(root), run(root)]
    samples = [item["sample"] for item in runs]
    passed = all(item["returncode"] == 0 and item["sample"] and item["sample"].get("status") == "verified" for item in runs)
    stable = samples[0] == samples[1]
    report: dict[str, Any] = {
        "schema": "authoritative-browser-restart-s6-06.v1",
        "task_id": "S6-06",
        "context_id": CONTEXT_ID,
        "status": "verified" if passed and stable else "blocked",
        "implementation_status": "verified" if passed and stable else "blocked",
        "scope": {"browser": "chromium", "mode": "persistent_profile_close_reopen", "record": "committed OPFS sync-access-handle record"},
        "checks": {
            "restart_probe": {"status": "verified" if passed else "blocked", "runs": runs, "stable": stable, "sample": samples[0]},
            "hash_continuity": {"status": "verified" if passed and samples[0].get("content_hash") == samples[1].get("content_hash") else "blocked"},
            "cleanup": {"status": "verified" if passed and samples[0].get("cleanup") is True else "blocked"},
            "process_crash_boundary": {"status": "blocked", "reason": "profile close/reopen is not process crash injection"},
            "safari_firefox_boundary": {"status": "out_of_scope", "reason": "Safari and Firefox are outside this project's migration scope"},
            "release_stop": {"status": "verified", "action": "STOP_RELEASE", "candidate_eligible": False},
        },
        "inputs": [artifact(root, path) for path in INPUTS],
        "boundaries": [
            "verified result covers a controlled Chromium profile close/reopen, not a process crash or power-loss oracle",
            "Safari and Firefox are explicitly OUT_OF_SCOPE for this migration",
            "release/oracle blockers remain STOP_RELEASE",
        ],
    }
    report["report_sha256"] = hashlib.sha256(canonical({key: value for key, value in report.items() if key != "report_sha256"}).encode()).hexdigest()
    output.parent.mkdir(parents=True, exist_ok=True)
    output.write_text(json.dumps(report, ensure_ascii=False, sort_keys=True, indent=2) + "\n", encoding="utf-8")
    return report


def main() -> int:
    parser = argparse.ArgumentParser(description=__doc__)
    parser.add_argument("--repo-root", type=Path, default=Path(__file__).resolve().parents[1])
    parser.add_argument("--report", type=Path, default=Path("coverage/authoritative-browser-restart-s6-06.report.json"))
    args = parser.parse_args()
    root = args.repo_root.resolve()
    output = args.report if args.report.is_absolute() else root / args.report
    report = generate(root, output)
    print(f"authoritative_browser_restart_s6_06={report['status']} stable={report['checks']['restart_probe']['stable']}")
    return 0 if report["status"] == "verified" else 1


if __name__ == "__main__":
    raise SystemExit(main())