#!/usr/bin/env python3
"""Deterministic offline verifier for the CHDB-20260831 static fixture."""
from __future__ import annotations
import csv, hashlib, io, json, re, sys
from pathlib import Path

ROOT = Path(__file__).resolve().parent
DISCLAIMER = "STATIC POLICY FIXTURE ONLY — NO NETWORK, SQL EXECUTION, SUBPROCESS, SERVER RESULT, SYNTAX CONFORMANCE, DEPLOYMENT EVIDENCE, OR INDEPENDENT VALIDATION."
ACCEPTED = "GRANT SELECT ON analytics_events.* TO analytics_events_reader;"
REJECTED = "GRANT SELECT ON *.* TO analytics_events_reader;"
REQUIRED = {
 "synthetic-schema-CHDB-20260831.sql", "accepted-scoped-grant-CHDB-20260831.sql",
 "rejected-broad-grant-CHDB-20260831.sql", "access-matrix-CHDB-20260831.csv",
 "expected-lint-CHDB-20260831.json", "access-scope-rules-CHDB-20260831.md",
 "assumption-register-CHDB-20260831.csv", "external-source-check-CHDB-20260831.md",
 "independent-reproduction-protocol-CHDB-20260831.md", "verify-CHDB-20260831.py",
}
EXPECTED_ROWS = [
 ("analytics_events.events","SELECT","EXPECTED ALLOW"),
 ("analytics_events.sessions","SELECT","EXPECTED ALLOW"),
 ("finance.invoices","SELECT","EXPECTED DENY"),
 ("analytics_events.events","INSERT","EXPECTED DENY"),
 ("analytics_events.events","ALTER","EXPECTED DENY"),
 ("analytics_events.events","DROP","EXPECTED DENY"),
 ("*.*","SELECT","LINT REJECT"),
]
WRITE_WORDS = ("INSERT","ALTER","DROP","CREATE","DELETE","UPDATE","TRUNCATE")

def sha256(path: Path) -> str:
 return hashlib.sha256(path.read_bytes()).hexdigest()

def grant_line(path: Path) -> str:
 lines=[x.strip() for x in path.read_text(encoding="utf-8").splitlines() if x.strip() and not x.lstrip().startswith("--")]
 return "\n".join(lines)

def main() -> int:
 print(DISCLAIMER)
 names={p.name for p in ROOT.iterdir() if p.is_file()}
 if names != REQUIRED:
  print(json.dumps({"file_set":"FAIL","missing":sorted(REQUIRED-names),"unexpected":sorted(names-REQUIRED)},indent=2)); return 1
 data=json.loads((ROOT/"expected-lint-CHDB-20260831.json").read_text(encoding="utf-8"))
 bad={n:{"expected":h,"computed":sha256(ROOT/n)} for n,h in data["sha256"].items() if sha256(ROOT/n)!=h}
 accepted=grant_line(ROOT/"accepted-scoped-grant-CHDB-20260831.sql")
 rejected=grant_line(ROOT/"rejected-broad-grant-CHDB-20260831.sql")
 rows=list(csv.DictReader((ROOT/"access-matrix-CHDB-20260831.csv").open(encoding="utf-8")))
 triples=[(r["resource"],r["action"],r["expected_status"]) for r in rows]
 write_in_accepted=[w for w in WRITE_WORDS if re.search(r"\b"+w+r"\b",accepted,re.I)]
 claim_terms={
  name: sorted(set(re.findall(r"\b(?:actual|observed)\b",(ROOT/name).read_text(encoding="utf-8"),re.I)))
  for name in data["sha256"]
  if re.search(r"\b(?:actual|observed)\b",(ROOT/name).read_text(encoding="utf-8"),re.I)
 }
 checks={"file_set":"PASS","hashes":"PASS" if not bad else "FAIL","accepted_exact":"PASS" if accepted==ACCEPTED else "FAIL","rejected_exact":"PASS" if rejected==REJECTED else "FAIL","matrix":"PASS" if triples==EXPECTED_ROWS and data["matrix"]==rows else "FAIL","accepted_has_no_write_grants":"PASS" if not write_in_accepted else "FAIL","no_actual_or_observed_claims":"PASS" if not claim_terms else "FAIL"}
 print(json.dumps({"pack_id":"CHDB-20260831","checks":checks,"claim_terms":claim_terms,"hash_mismatches":bad,"write_tokens":write_in_accepted,"warnings":data["warnings"]},indent=2,sort_keys=True))
 ok=all(v=="PASS" for v in checks.values())
 print("PASS: deterministic static fixture reproduced." if ok else "FAIL: static fixture mismatch.")
 return 0 if ok else 1

if __name__ == "__main__":
 sys.exit(main())