# Sovereign AGI Kernel — CI Pipeline
# Enforces: air-gap build, entropy validation, WORM commitment
# GATES: build fails if entropy > 0.20, if forbidden zones violated,
# or if unverified code touches the kernel directly.

stages:
  - forbidden_check
  - sovereign_build
  - entropy_validation
  - runtime_verification
  - worm_commit

# --- Gate 1: Forbidden Zone Enforcement ---
forbidden_check:
  stage: forbidden_check
  script:
    - echo "=== FORBIDDEN ZONE CHECK ==="
    # No /models/ directory (unverifiable weights)
    - "[ ! -d models/ ] || (echo 'FORBIDDEN: /models/ directory exists' && exit 1)"
    # No /data/ directory (breaks air-gap sovereignty)
    - "[ ! -d data/ ] || (echo 'FORBIDDEN: /data/ directory exists' && exit 1)"
    # No direct kernel imports from unverified code
    - |
      if grep -r "import ErdosStraus" --include="*.hs" --include="*.py" --include="*.js" .; then
        echo "FORBIDDEN: Untyped code imports kernel directly"
        echo "Use Reasoning_IDL.idr interface instead"
        exit 1
      fi
    # No sorry/believe_me in kernel (except ErdosStraus.idr which uses believe_me for omega proofs)
    - |
      if grep -n "sorry" idris/AgentModel.idr idris/WORM_Audit.idr idris/Reasoning_IDL.idr idris/SovereignKernel.idr idris/FlightTypes.idr idris/FlightKernel.idr idris/FlightWORM.idr idris/FlightGate.idr 2>/dev/null; then
        echo "FORBIDDEN: sorry found in sovereign kernel modules"
        exit 1
      fi
    # No direct FlightKernel imports from unverified code (must use FlightGate)
    - |
      if grep -r "import FlightKernel\|import FlightTypes\|import FlightWORM" --include="*.py" --include="*.js" --include="*.mjs" .; then
        echo "FORBIDDEN: Untyped code bypasses FlightGate"
        echo "Use FlightGate.idr interface for all flight requests"
        exit 1
      fi
    - echo "=== FORBIDDEN ZONE: CLEAR ==="

# --- Gate 2: Air-Gapped Sovereign Build ---
sovereign_build:
  stage: sovereign_build
  script:
    - echo "=== SOVEREIGN BUILD (AIR-GAPPED) ==="
    - docker build --target final -t erdos-straus-verified:$CI_COMMIT_SHA .
    - docker run --rm --network=none erdos-straus-verified:$CI_COMMIT_SHA cat manifest.txt
    - echo "=== BUILD: COMPLETE ==="
  artifacts:
    paths:
      - kernel/artifacts/verified_kernel.wasm
      - kernel/artifacts/artifact.hash
  needs: [forbidden_check]

# --- Gate 3: Entropy Validation ---
entropy_validation:
  stage: entropy_validation
  script:
    - echo "=== ENTROPY VALIDATION ==="
    # Idris 2 type-checks AgentModel.idr — FAILS if entropy > 20 possible
    - cd Idris && idris2 --check AgentModel.idr
    - cd Idris && idris2 --check WORM_Audit.idr
    - cd Idris && idris2 --check Reasoning_IDL.idr
    - cd Idris && idris2 --check SovereignKernel.idr
    # All files must be %default total
    - |
      for f in Idris/*.idr; do
        if ! head -5 "$f" | grep -q "%default total"; then
          echo "ENTROPY VIOLATION: $f is not declared total"
          exit 1
        fi
      done
    - echo "=== ENTROPY: ALL BOUNDED (compile-time proof) ==="
  needs: [sovereign_build]

# --- Gate 4: Runtime Verification ---
runtime_verification:
  stage: runtime_verification
  script:
    - echo "=== RUNTIME VERIFICATION ==="
    - cd runtime && node main.mjs > output.txt 2>&1
    - grep -q "All gap inequalities hold: VERIFIED" runtime/output.txt
    - cd scaffold && python3 agi_gate.py > gate_output.txt 2>&1
    - grep -q "PROVEN" scaffold/gate_output.txt
    - echo "=== RUNTIME: ALL CHECKS PASSED ==="
  needs: [entropy_validation]

# --- Gate 5: WORM Chain Commitment ---
worm_commit:
  stage: worm_commit
  script:
    - echo "=== WORM CHAIN COMMITMENT ==="
    # Hash all verified artifacts
    - sha256sum Idris/*.idr Erdos/*.lean runtime/*.mjs > BUILD_SEAL.txt
    # Commit hash to audit trail
    - |
      echo "{\"commit\":\"$CI_COMMIT_SHA\",\"timestamp\":\"$(date -u +%Y-%m-%dT%H:%M:%SZ)\",\"seal\":\"$(sha256sum BUILD_SEAL.txt | cut -d' ' -f1)\",\"status\":\"verified\"}" >> audit/commitments/latest.jsonl
    - echo "=== WORM: COMMITTED (append-only) ==="
  needs: [runtime_verification]
  only:
    - tags
    - main