#!/usr/bin/env python3
"""Snapshot and validate completion-final batch artifacts without trusting worker self-reports."""

import argparse
import hashlib
import json
import subprocess
from datetime import datetime, timezone
from pathlib import Path


def sha256(path: Path) -> str:
    return hashlib.sha256(path.read_bytes()).hexdigest()


def main() -> None:
    parser = argparse.ArgumentParser()
    parser.add_argument("--validator", required=True, type=Path)
    parser.add_argument("--receipt", required=True, type=Path)
    parser.add_argument("batches", nargs="+", type=Path)
    args = parser.parse_args()

    results = []
    for source in args.batches:
        raw = source.read_bytes()
        payload = json.loads(raw)
        digest = hashlib.sha256(raw).hexdigest()
        part_range = payload.get("part_range")
        if not isinstance(part_range, list) or len(part_range) != 2:
            raise SystemExit(f"invalid part_range: {source}")

        snapshot = source.with_name(
            f"{source.stem}_completion_final_{digest[:12]}.json"
        )
        snapshot.write_bytes(raw)
        if sha256(snapshot) != digest:
            raise SystemExit(f"snapshot checksum mismatch: {snapshot}")

        check = subprocess.run(
            ["python3", str(args.validator), str(snapshot)],
            text=True,
            capture_output=True,
        )
        if sha256(snapshot) != digest:
            raise SystemExit(f"snapshot mutated during validation: {snapshot}")

        validation = None
        if check.stdout.strip():
            try:
                validation = json.loads(check.stdout)
            except json.JSONDecodeError:
                validation = {"raw_stdout": check.stdout.strip()}

        results.append(
            {
                "source": str(source),
                "snapshot": str(snapshot),
                "sha256": digest,
                "part_range": part_range,
                "accepted": check.returncode == 0,
                "validator_exit": check.returncode,
                "validation": validation,
                "stderr": check.stderr.strip(),
            }
        )

    receipt = {
        "status": "passed" if all(x["accepted"] for x in results) else "partial_rejection",
        "authoritative_completion_required_before_invocation": True,
        "created_at": datetime.now(timezone.utc).isoformat(),
        "policy": "preserve rejected snapshots; remediate only failed batches; assemble explicit accepted paths",
        "batches": results,
    }
    args.receipt.parent.mkdir(parents=True, exist_ok=True)
    args.receipt.write_text(json.dumps(receipt, ensure_ascii=False, indent=2) + "\n")
    print(json.dumps(receipt, ensure_ascii=False))


if __name__ == "__main__":
    main()