// Separate local execution ledger; never changes the historical PLANNED plan,
// K501–K600 contract, frozen K559 inputs, published site, or default Image.
import assert from 'node:assert/strict';
import { spawnSync } from 'node:child_process';
import { copyFileSync, mkdirSync, mkdtempSync, readFileSync, symlinkSync, writeFileSync } from 'node:fs';
import { dirname, join, relative, resolve } from 'node:path';
import { fileURLToPath } from 'node:url';
import { frozenSnapshot, hashAt, inspectBootContractReport, MUTANTS, sourceSnapshot } from './boot-contract-report.mjs';

const root = resolve(dirname(fileURLToPath(import.meta.url)), '../..');
const protectedBefore = frozenSnapshot(root);
const sources = sourceSnapshot(root);
const parent = join(root, 'reports/os-implementation'); mkdirSync(parent, { recursive: true });
const runDir = mkdtempSync(join(parent, 'K601-K604-'));
const runDirectory = relative(root, runDir);
const commands = [];
const artifact = path => ({ path: relative(root, path), sha256: hashAt(root, relative(root, path)) });
const sanitize = value => value.split(root).join('<project>');
const manifest = join(root, 'os-runtime/Cargo.toml');
const target = join(runDir, 'target');

function command(id, argv, env = {}) {
  console.log(`RUN ${id}: ${sanitize(argv.join(' '))}`);
  const result = spawnSync('cargo', argv, { cwd: root, encoding: 'utf8', timeout: 120_000,
    maxBuffer: 8 * 1024 * 1024, env: { ...process.env, CARGO_TARGET_DIR: target, ...env } });
  const path = join(runDir, `${id}.log`);
  writeFileSync(path, sanitize(`${result.stdout ?? ''}${result.stderr ?? ''}`));
  assert.equal(result.error, undefined, `command timed out/failed to launch: ${id}`);
  return { id, argv: argv.map(sanitize), exitCode: result.status, log: artifact(path) };
}
function run(id, argv) {
  const result = command(id, argv); commands.push(result);
  assert.equal(result.exitCode, 0, `failed ${id}; keep the diagnostic at ${result.log.path}`);
}
const args = ['--manifest-path', manifest, '--locked', '--offline'];
run('fmt', ['fmt', '--manifest-path', manifest, '--', '--check']);
run('host', ['test', ...args, '--test', 'boot_contract', '--', '--nocapture']);
run('positive', ['test', ...args, '--test', 'boot_contract', 'origin_positive', '--', '--nocapture']);
run('negative', ['test', ...args, '--test', 'boot_contract', 'origin_negative', '--', '--nocapture']);
run('arm64', ['build', ...args, '--lib', '--target', 'aarch64-unknown-none']);
run('clippy', ['clippy', ...args, '--lib', '--tests', '--examples', '--no-deps', '--', '-D', 'warnings']);
const fixtureDir = join(runDir, 'fixtures');
run('fixtures', ['run', ...args, '--example', 'boot-contract-fixtures', '--', fixtureDir]);

// Mechanical source mutations only in generated test copies. The real source
// never changes. Preserve failures/source instead of discarding bad test runs.
const original = readFileSync(join(root, 'os-runtime/src/boot_contract.rs'), 'utf8');
const crateInputs = sources.filter(row => row.path.startsWith('os-runtime/')).map(row => row.path);
const mutations = [];
for (const mutation of MUTANTS) {
  const directory = join(runDir, mutation.id); mkdirSync(directory);
  symlinkSync(join(root, 'kernel'), join(directory, 'kernel'));
  symlinkSync(join(root, 'bootinfo'), join(directory, 'bootinfo'));
  for (const path of crateInputs) {
    const dest = join(directory, path); mkdirSync(dirname(dest), { recursive: true });
    copyFileSync(join(root, path), dest);
  }
  assert.equal(original.split(mutation.needle).length, 2);
  const mutatedPath = join(directory, 'os-runtime/src/boot_contract.rs');
  writeFileSync(mutatedPath, original.replace(mutation.needle, mutation.replacement));
  const result = command(mutation.id, ['test', '--manifest-path', join(directory, 'os-runtime/Cargo.toml'),
    '--locked', '--offline', '--test', 'boot_contract', mutation.test, '--', '--exact', '--nocapture'],
    { CARGO_TARGET_DIR: join(directory, 'target') });
  assert.equal(result.exitCode, 101, `blind mutation test: ${mutation.id}`);
  mutations.push({ id: mutation.id, test: mutation.test, exitCode: result.exitCode, log: result.log, source: artifact(mutatedPath) });
}

const protectedAfter = frozenSnapshot(root);
assert.deepEqual(protectedAfter, protectedBefore);
assert.deepEqual(sourceSnapshot(root), sources, 'sources changed while local verification ran');
const common = {
  actualSource: 'os-runtime/src/boot_contract.rs', plannedSource: 'kernel/src/runtime/boot_contract.rs',
  productAccepted: false,
  boundary: 'Host library only. No mapped-pointer proof, firmware map ownership, guest entry adapter, product Image or security review of the new module.',
};
const moves = [
  { ...common, id: 'K601', stage: 'contract', status: 'LOCAL_VALIDATED',
    reason: 'Separate boot sources before parsing so a UEFI validation failure can never masquerade as direct boot.',
    test: 'Documented input/state/error table and the 18 executed contract assertions.',
    counterexample: 'Nonzero x1 paired with DTB bytes must return Header(Magic), not a fallback result.' },
  { ...common, id: 'K602', stage: 'implementation', status: 'LOCAL_VALIDATED',
    reason: 'Implement a no_std, unsafe-free, allocation-free origin resolver with owned metadata and checked physical ranges.',
    test: 'Host tests, AArch64 bare-metal library build, fmt and warning-free clippy for this new crate.',
    counterexample: 'Missing/mislabelled header, bad address, overflow or overlapping Image/DTB produces an explicit error.' },
  { ...common, id: 'K603', stage: 'positive', status: 'LOCAL_VALIDATED',
    reason: 'Both entry paths must preserve equal discovered RAM and distinct source tags in all three planned RAM profiles.',
    test: '4 positive tests; real DTB parser for synthetic 256/512/1024 MiB fixtures, copied metadata, exact boundary adjacency.',
    counterexample: 'A branch returning a different RAM extent or sharing one source tag would fail the complete-state assertions.' },
  { ...common, id: 'K604', stage: 'negative', status: 'LOCAL_VALIDATED',
    reason: 'A negative test must detect broken policy rather than merely return an error on an unrelated input.',
    test: '14 negative tests, all 71 nonempty truncated header lengths and 4 controlled faulty source copies rejected by assertion failures.',
    counterexample: 'Fallback, contradictory payload acceptance, false physical header label and ignored Image/DTB overlap each fail their targeted test.' },
  { ...common, id: 'K605', stage: 'integration', status: 'BLOCKED_REVIEW_FREEZE',
    reason: 'The reviewed kernel has no import/call for this module. Adding an entry adapter would modify frozen kernel/src/lib.rs and main.rs.',
    test: 'Not run: same product Image direct+UEFI matrix and genuine malformed-entry guest rejection still required.',
    counterexample: 'Successful old Image boots or a separate probe Image cannot show the new resolver executed in the product.' },
];
const report = {
  schema: 'turkos-os-local-execution/v1', feature: 'boot_contract.origin', scope: 'host-library-only',
  createdAt: new Date().toISOString(), runDirectory,
  counts: { locallyValidated: 4, guestAccepted: 0, blocked: 1, notStarted: 1895 },
  policy: { release: 'experimental', productionWrite: 'blocked', published: false,
    defaultImageChanged: false, productIntegration: false, firmwareMapOwnershipProven: false },
  sources, protectedBefore, protectedAfter, commands, mutations, moves,
  fixtures: [256, 512, 1024].flatMap(mib => [artifact(join(fixtureDir, `ram-${mib}.dtb`)), artifact(join(fixtureDir, `uefi-${mib}.header`))]),
  arm64Library: artifact(join(target, 'aarch64-unknown-none/debug/libturkos_os_runtime.rlib')),
  guestRuns: 0, k605MarkerObserved: false,
};
const accepted = inspectBootContractReport(report, root);
const reportPath = join(runDir, 'report.json');
writeFileSync(reportPath, `${JSON.stringify(report, null, 2)}\n`);
console.log(`LOCAL VALIDATED: ${JSON.stringify(accepted)}`);
console.log(`Report: ${relative(root, reportPath)}`);
console.log('K605 pending: frozen product entry not changed; no guest/production acceptance or publication.');