#!/usr/bin/env python3
"""Freeze the oracle truth for the GO port of src/rune/verification_layer.py
(dichotomy wave #2479, GO). Every public function, every branch, against the
LIVE oracle (which delegates to the Rust evidence_provenance core — parity
already proven 33/33). Rows pin the full VerificationResult field set AND the
byte-exact json.dumps(to_dict()) rendering. handle_hook + PLUGIN pinned too.
"""
from __future__ import annotations

import json
import os
import sys
from pathlib import Path

ROOT = Path(__file__).resolve().parents[1]
sys.path.insert(0, str(ROOT / "src"))

from rune import verification_layer as vl  # noqa: E402

FIXTURE = ROOT / "src/go/verification_layer/.fixtures/exists.txt"

rows: list[dict] = []


def row(name, fn, verifier_type, result):
    got = getattr(vl, fn)(dict(result), verifier_type) if fn == "verify" \
        else getattr(vl, fn)(dict(result))
    rows.append({
        "name": name,
        "fn": fn,
        "verifier_type": verifier_type,
        "result": result,
        "want": got.to_dict(),
        "want_json": json.dumps(got.to_dict()),
    })


def hook_row(name, event, data=None):
    got = vl.handle_hook(event) if data is None else vl.handle_hook(event, data)
    rows.append({
        "name": name,
        "fn": "handle_hook",
        "verifier_type": "",
        "result": {"event": event, "data": data},
        "want": got,
        "want_json": json.dumps(got, sort_keys=True),
    })


# ── verify_exit_code: every branch ──────────────────────────────────────────
row("exit_code:absent-defaults-0", "verify_exit_code", "exit_code", {})
row("exit_code:zero-pass", "verify_exit_code", "exit_code", {"exit_code": 0})
row("exit_code:one-fail", "verify_exit_code", "exit_code", {"exit_code": 1})
row("exit_code:negative-fail", "verify_exit_code", "exit_code", {"exit_code": -3})
row("exit_code:float-zero-pass", "verify_exit_code", "exit_code", {"exit_code": 0.0})
row("exit_code:float-frac-fail", "verify_exit_code", "exit_code", {"exit_code": 0.5})
row("exit_code:bool-true-fails", "verify_exit_code", "exit_code", {"exit_code": True})
row("exit_code:bool-false-passes", "verify_exit_code", "exit_code", {"exit_code": False})
row("exit_code:str-zero-not-equal", "verify_exit_code", "exit_code", {"exit_code": "0"})
row("exit_code:null-not-equal", "verify_exit_code", "exit_code", {"exit_code": None})
row("exit_code:big-int-evidence", "verify_exit_code", "exit_code", {"exit_code": 91247})

# ── verify_unit_test ────────────────────────────────────────────────────────
row("unit_test:all-defaults-total-zero-fails", "verify_unit_test", "unit_test", {})
row("unit_test:pass", "verify_unit_test", "unit_test",
    {"tests_passed": 10, "tests_failed": 0, "tests_total": 10})
row("unit_test:two-fail", "verify_unit_test", "unit_test",
    {"tests_passed": 3, "tests_failed": 2, "tests_total": 5})
row("unit_test:failed-zero-total-positive", "verify_unit_test", "unit_test",
    {"tests_failed": 0, "tests_total": 7})
row("unit_test:bool-failed-false-total-true", "verify_unit_test", "unit_test",
    {"tests_failed": False, "tests_total": True})
row("unit_test:failed-true-counts-1", "verify_unit_test", "unit_test",
    {"tests_failed": True, "tests_total": 1})
row("unit_test:str-total-ignored", "verify_unit_test", "unit_test",
    {"tests_total": "5", "tests_failed": 0})

# ── verify_schema ───────────────────────────────────────────────────────────
row("schema:defaults-pass", "verify_schema", "schema", {})
row("schema:valid-true-no-errors", "verify_schema", "schema", {"schema_valid": True})
row("schema:invalid-fail", "verify_schema", "schema", {"schema_valid": False})
row("schema:errors-fail", "verify_schema", "schema",
    {"schema_valid": True, "schema_errors": ["bad type at $.a", "missing $.b"]})
row("schema:empty-errors-pass", "verify_schema", "schema",
    {"schema_valid": True, "schema_errors": []})
row("schema:errors-nonlist-ignored", "verify_schema", "schema",
    {"schema_valid": True, "schema_errors": "nope"})
row("schema:errors-with-nested-values", "verify_schema", "schema",
    {"schema_valid": False, "schema_errors": [3, {"path": "$.x", "msg": "type"}, True]})
row("schema:valid-null-defaults-true", "verify_schema", "schema",
    {"schema_valid": None})
row("schema:valid-zero-falsy", "verify_schema", "schema", {"schema_valid": 0})
row("schema:valid-truthy-str", "verify_schema", "schema", {"schema_valid": "yes"})
row("schema:unicode-error-escaping", "verify_schema", "schema",
    {"schema_valid": False, "schema_errors": ["ungültig bei „$.pfad“"]})

# ── verify_file_exists (fixture file is committed next to the port) ────────
row("file_exists:exists-pass", "verify_file_exists", "file_exists",
    {"file_path": str(FIXTURE)})
row("file_exists:missing-fail", "verify_file_exists", "file_exists",
    {"file_path": str(ROOT / "src/go/verification_layer/.fixtures/definitely_missing.txt")})
row("file_exists:empty-path-fail", "verify_file_exists", "file_exists",
    {"file_path": ""})
row("file_exists:dir-counts", "verify_file_exists", "file_exists",
    {"file_path": str(ROOT / "src/go/verification_layer/.fixtures")})
row("file_exists:absent-key-fail", "verify_file_exists", "file_exists", {})

# ── verify_file_changed ─────────────────────────────────────────────────────
row("file_changed:empty-expected-pass", "verify_file_changed", "file_changed",
    {"file_path": "a.txt", "expected_hash": "", "actual_hash": "deadbeef"})
row("file_changed:match-pass", "verify_file_changed", "file_changed",
    {"file_path": "a.txt", "expected_hash": "cafe", "actual_hash": "cafe"})
row("file_changed:mismatch-fail", "verify_file_changed", "file_changed",
    {"file_path": "a.txt", "expected_hash": "cafe", "actual_hash": "beef"})
row("file_changed:no-keys-pass", "verify_file_changed", "file_changed", {})

# ── verify_tool_receipt ─────────────────────────────────────────────────────
row("tool_receipt:default-pass", "verify_tool_receipt", "tool_receipt", {})
row("tool_receipt:success-true", "verify_tool_receipt", "tool_receipt",
    {"tool_success": True, "tool_name": "grep"})
row("tool_receipt:fail-with-error", "verify_tool_receipt", "tool_receipt",
    {"tool_success": False, "tool_error": "boom: exit 2"})
row("tool_receipt:fail-empty-error", "verify_tool_receipt", "tool_receipt",
    {"tool_success": False})
row("tool_receipt:zero-falsy", "verify_tool_receipt", "tool_receipt",
    {"tool_success": 0, "tool_error": "falsy rc"})
row("tool_receipt:error-str-truthy", "verify_tool_receipt", "tool_receipt",
    {"tool_success": "ok"})

# ── verify_constraint_check ─────────────────────────────────────────────────
row("constraint:default-pass", "verify_constraint_check", "constraint_check", {})
row("constraint:met-true-pass", "verify_constraint_check", "constraint_check",
    {"constraints_met": True})
row("constraint:unmet-fail", "verify_constraint_check", "constraint_check",
    {"constraints_met": False})
row("constraint:violations-fail", "verify_constraint_check", "constraint_check",
    {"constraints_met": True, "constraint_violations": ["no secrets in diff"]})
row("constraint:violations-nested", "verify_constraint_check", "constraint_check",
    {"constraints_met": False,
     "constraint_violations": [{"rule": "R1", "at": 7}, 12, None]})

# ── verify dispatch (named + unknown) ───────────────────────────────────────
for vt in ("exit_code", "unit_test", "schema", "file_exists", "file_changed",
           "tool_receipt", "constraint_check"):
    row(f"dispatch:{vt}", "verify", vt, {})
row("dispatch:unknown-verifier", "verify", "nonexistent_verifier", {})
row("dispatch:unknown-empty-name", "verify", "", {})
row("dispatch:unknown-case-sensitive", "verify", "Exit_Code", {"exit_code": 0})

# ── handle_hook ─────────────────────────────────────────────────────────────
hook_row("hook:event-only", "verification.request")
hook_row("hook:event-with-data", "verification.done", {"passed": True})

# ── PLUGIN manifest ─────────────────────────────────────────────────────────
rows.append({
    "name": "plugin:manifest",
    "fn": "plugin",
    "verifier_type": "",
    "result": {},
    "want": vl.PLUGIN,
    "want_json": json.dumps(vl.PLUGIN, sort_keys=True),
})

doc = {
    "frozen_ts": "2026-10-12T00:00:00+00:00",
    "generator": "scripts/gen_verification_layer_truth.py — live oracle "
                 "src/rune/verification_layer.py (Rust evidence_provenance core)",
    "rows": rows,
}
out = ROOT / "src/go/verification_layer/truth.json"
out.write_text(json.dumps(doc, indent=1, ensure_ascii=False) + "\n",
               encoding="utf-8")
print(f"frozen {len(rows)} rows → {out}")