"""Portable integrity/development admission, never a model or rights certificate."""
import hashlib
from pathlib import Path

from . import _windows
from .protocol import decode

TOKENIZER_FILES = {'tokenizer.json', 'tokenizer_config.json', 'special_tokens_map.json'}
WINDOW_GATE_MODE = 'supervised-owned-parent-window-gated'
WINDOW_GATE_PROFILE = 'CLS-window-gated-linear-heads-v1'
SOURCE_KIND_MODE = 'supervised-owned-parent-source-kind-gated'
SOURCE_KIND_PROFILE = 'CLS-source-kind-gated-linear-heads-v1'


def sha(path, limit):
    total = 0
    digest = hashlib.sha256()
    with Path(path).open('rb') as stream:
        while chunk := stream.read(1024 * 1024):
            total += len(chunk)
            if total > limit:
                raise ValueError('artifact_byte_limit')
            digest.update(chunk)
    return digest.hexdigest()


def _file(root, name):
    path = (root / name).resolve(strict=True)
    if not path.is_relative_to(root) or not path.is_file():
        raise ValueError('artifact_path_escape')
    return path


def _json(root, name, limit):
    path = _file(root, name)
    with path.open('rb') as stream:
        data = stream.read(limit + 1)
    if len(data) > limit:
        raise ValueError('artifact_byte_limit')
    return decode(data)


def _inspect_source_kind(root, report, revision):
    recipe = report['recipe']
    parent = report.get('parent_checkpoint_sha256')
    if (report.get('runtime_admitted') is not True
            or not isinstance(parent, str) or len(parent) != 64 or parent == revision
            or any(c not in '0123456789abcdef' for c in parent)
            or recipe.get('gate_input') != 'encoder_CLS_per_window'
            or type(recipe.get('gate_threshold')) is not int or recipe['gate_threshold'] != 0
            or recipe.get('branch_order') != ['service', 'log', 'base']
            or recipe.get('log_bias') != 'shared_frozen_base_head_bias'
            or recipe.get('additional_parameters') != 1537
            or any(recipe.get(k) is not True for k in ('encoder_frozen', 'base_head_frozen',
                'service_gate_and_head_frozen', 'original_parameters_bitwise_unchanged'))):
        raise ValueError('frozen_source_kind_parent_profile_required')
    files = {'__init__.py', '__main__.py', '_model.py', '_window_gate.py', '_source_kind.py',
             '_windows.py', 'artifact.py', 'bootstrap.py', 'protocol.py', 'runtime.py'}
    package = Path(__file__).resolve().parent
    pins = report.get('runtime_files_sha256')
    if (not isinstance(pins, dict) or set(pins) != files
            or {p.name for p in package.glob('*.py')} != files
            or any(sha(package / n, 128 * 1024) != digest for n, digest in pins.items())):
        raise ValueError('complete_source_kind_runtime_code_pins_required')
    if (sha(package / '_window_gate.py', 128 * 1024) != report.get('window_gate_code_sha256')
            or sha(package / '_source_kind.py', 128 * 1024) != report.get('source_kind_model_code_sha256')):
        raise ValueError('source_kind_model_code_hash_mismatch')
    evidence = report.get('source_kind_evidence')
    required = {'SOURCE-KIND-TRAIN-AUDIT.json', 'SOURCE-KIND-GPU-AUDIT.json', 'SOURCE-KIND-NATIVE-AUDIT.json'}
    if not isinstance(evidence, dict) or set(evidence) != required:
        raise ValueError('complete_source_kind_development_evidence_required')
    proofs = {}
    for name, digest in evidence.items():
        if sha(_file(root, name), 1024 * 1024) != digest:
            raise ValueError('source_kind_evidence_hash_mismatch')
        proof = _json(root, name, 1024 * 1024)
        if (not isinstance(proof, dict) or proof.get('checkpoint_sha256') != revision
                or any(proof.get(k) is not False for k in ('qualification', 'promotion_ready', 'release_approved'))):
            raise ValueError('unqualified_source_kind_evidence_required')
        proofs[name] = proof
    train = proofs['SOURCE-KIND-TRAIN-AUDIT.json']
    gpu = proofs['SOURCE-KIND-GPU-AUDIT.json']
    native = proofs['SOURCE-KIND-NATIVE-AUDIT.json']
    if (train.get('status') != 'independent_source_kind_TRAIN_audit_passed_not_qualification'
            or train.get('parent_checkpoint_sha256') != parent
            or train.get('encoder_and_original_heads_bitwise_identical') is not True
            or train.get('gate_constraints') != 3384
            or type(train.get('minimum_FP32_signed_margin')) not in (int, float)
            or not .9999 <= train['minimum_FP32_signed_margin'] <= 1e6
            or train.get('log_head_TRAIN_audit_passed') is not True
            or train.get('DEV_used_in_fit') is not False or train.get('heldout_access') is not False
            or gpu.get('status') != 'independent_source_kind_906window_GPU_audit_passed_not_qualification'
            or gpu.get('actual_GPU_cases') != 880 or gpu.get('actual_GPU_windows') != 906
            or gpu.get('all871_CPU_GPU_source_parity_verified') is not True
            or gpu.get('Java_log_windows') != 5 or gpu.get('five_family_windows') != 30
            or gpu.get('original_mask_bindings_verified') != 871
            or gpu.get('route_misses') != [] or gpu.get('all_parameters_bitwise_unchanged') is not True
            or gpu.get('new_revision_response_identity_verified') is not True
            or native.get('status') != 'independent_source_kind_native_DEV_audit_passed_not_qualification'
            or native.get('all348_native_source_allocations_exact_required_budget_valid') is not True
            or native.get('all16_Java_native_allocations_exact_required_budget_valid') is not True
            or native.get('budgets') != [.25, .5] or native.get('known_support_losses') != []
            or native.get('original_masks_unchanged') is not True
            or native.get('retained_group_identity_verified') is not True):
        raise ValueError('source_kind_full_development_evidence_required_not_qualification')
    if any(report.get(k) is not False for k in ('qualification', 'promotion_ready', 'release_approved', 'redistribution_cleared')):
        raise ValueError('source_kind_development_is_not_release_clearance')


def inspect_artifact(directory, revision):
    """Check bytes/declared completion only, with no imports of ML frameworks."""
    if (not isinstance(revision, str) or len(revision) != 64
            or any(c not in '0123456789abcdef' for c in revision)):
        raise ValueError('checkpoint_SHA256_required')
    root = Path(directory)
    if not root.is_absolute():
        raise ValueError('absolute_artifact_path_required')
    root = root.resolve(strict=True)
    report = _json(root, 'training-report.json', 1024 * 1024)
    recipe = report.get('recipe', {}) if isinstance(report, dict) else {}
    mode = report.get('mode') if isinstance(report, dict) else None
    supported_recipe = isinstance(recipe, dict) and (
        (mode == 'supervised-foundation-feature-distilled'
         and recipe.get('objective_profile') == 'optional-balanced-window-hardpair-headwarm-v4')
        or (mode == WINDOW_GATE_MODE and recipe.get('objective_profile') == WINDOW_GATE_PROFILE)
        or (mode == SOURCE_KIND_MODE and recipe.get('objective_profile') == SOURCE_KIND_PROFILE))
    if (not isinstance(report, dict) or not isinstance(report.get('recipe'), dict)
            or report.get('status') != 'completed_development_only'
            or report.get('checkpoint_sha256') != revision
            or not supported_recipe
            or report.get('recipe', {}).get('precision') != 'fp32'
            or report.get('recipe', {}).get('student_token_cap') != 8192):
        raise ValueError('completed_clean_compact12_development_artifact_required')
    _windows.verify_profile(report)
    if sha(Path(__file__).with_name('_model.py'), 128 * 1024) != report.get('joint_model_code_sha256'):
        raise ValueError('model_code_hash_mismatch')
    if mode == SOURCE_KIND_MODE:
        _inspect_source_kind(root, report, revision)
    if mode == WINDOW_GATE_MODE:
        parent = report.get('parent_checkpoint_sha256')
        if (not isinstance(parent, str) or len(parent) != 64 or parent == revision
                or any(c not in '0123456789abcdef' for c in parent)
                or recipe.get('gate_input') != 'encoder_CLS_per_window'
                or recipe.get('encoder_frozen') is not True or recipe.get('base_head_frozen') is not True):
            raise ValueError('frozen_owned_parent_window_gate_profile_required')
        if sha(Path(__file__).with_name('_window_gate.py'), 128 * 1024) != report.get('window_gate_code_sha256'):
            raise ValueError('window_gate_code_hash_mismatch')
        evidence = report.get('window_gate_evidence')
        required = {'WINDOW-GATE-TRAIN-AUDIT.json', 'WINDOW-GATE-DEV-AUDIT.json'}
        if not isinstance(evidence, dict) or set(evidence) != required:
            raise ValueError('window_gate_evidence_pins_required')
        for name, digest in evidence.items():
            if sha(_file(root, name), 1024 * 1024) != digest:
                raise ValueError('window_gate_evidence_hash_mismatch')
        train = _json(root, 'WINDOW-GATE-TRAIN-AUDIT.json', 1024 * 1024)
        dev = _json(root, 'WINDOW-GATE-DEV-AUDIT.json', 1024 * 1024)
        if (not isinstance(train, dict) or not isinstance(dev, dict)
                or train.get('status') != 'independent_CLS_window_gate_TRAIN_audit_passed_not_qualification'
                or train.get('checkpoint_sha256') != revision
                or train.get('encoder_and_original_head_bitwise_identical') is not True
                or dev.get('status') != 'independently_replayed_prerequisite_pass'
                or dev.get('all871_CPU_GPU_source_parity_verified') is not True
                or dev.get('known_support_losses') != []
                or any(proof.get('qualification') is not False or proof.get('promotion_ready') is not False
                       for proof in (train, dev))):
            raise ValueError('window_gate_development_evidence_required_not_qualification')
    config = _json(root, 'config.json', 65536)
    if (not isinstance(config, dict) or config.get('model_type') != 'modernbert' or config.get('num_hidden_layers') != 12
            or config.get('hidden_size') != 768 or config.get('max_position_embeddings') != 8192
            or config.get('layer_types') != ['full_attention' if i % 3 == 0 else 'sliding_attention' for i in range(12)]):
        raise ValueError('compact12_configuration_required')
    if sha(_file(root, 'config.json'), 65536) != report.get('config_sha256'):
        raise ValueError('config_hash_mismatch')
    if sha(_file(root, 'checkpoint.pt'), 1024**3) != revision:
        raise ValueError('weights_hash_mismatch')
    pins = report.get('tokenizer_sha256')
    if not isinstance(pins, dict) or set(pins) != TOKENIZER_FILES:
        raise ValueError('complete_tokenizer_pins_required')
    if {p.name for p in (root / 'tokenizer').iterdir()} != TOKENIZER_FILES:
        raise ValueError('tokenizer_files_mismatch')
    for name, digest in pins.items():
        if sha(_file(root, 'tokenizer/' + name), 32 * 1024**2) != digest:
            raise ValueError('tokenizer_hash_mismatch')
    decision = _json(root, 'DEVELOPMENT-DECISION.json', 1024 * 1024)
    if (not isinstance(decision, dict) or decision.get('checkpoint_sha256') != revision
            or any(decision.get(key) is not True for key in
                   ('training_completed', 'completion_content_audit_passed', 'development_stop_go_passed'))
            or any(decision.get(key) is not False for key in ('qualification', 'release_approved', 'redistribution_cleared'))):
        raise ValueError('accepted_development_decision_required_not_release')
    return report