#!/usr/bin/env python3
"""Offline, IP-safe reference-only industrial gate verifier (not proprietary engines)."""
import argparse, datetime, hashlib, json, os, platform, random, resource, statistics, subprocess, sys, tempfile, time
from pathlib import Path

SEED=20261108
N=30
MODULES=('logverity','stream','state','memory','serialization','replay')
SCENARIOS=('steady','burst','fault','recovery')

def hx(data):return hashlib.sha256(data).hexdigest()
def jbytes(x):return json.dumps(x,sort_keys=True,separators=(',',':')).encode()
def redacted(t):return {'event_id':t['id'],'audit':t['audit'],'message':t['message'] if t['audit'] else t['message'].replace('secret','[redacted]')}
def stream_result(t):return (t['x']*17+t['y']*31)%10007
def ref_stream(t):return ((t['x']*17)+(31*t['y']))%10007

def eval_case(module,scenario,repeat):
 r=random.Random(SEED+repeat*17+SCENARIOS.index(scenario)*997+MODULES.index(module)*10003)
 if module=='logverity':
  inp={'id':repeat,'audit':scenario in ('steady','recovery'),'message':'secret event' if scenario in ('fault','burst') else 'normal event'}
  got=redacted(inp); exp={'event_id':inp['id'],'audit':inp['audit'],'message':inp['message'] if inp['audit'] else inp['message'].replace('secret','[redacted]')};return got==exp and (inp['audit'] or 'secret' not in got['message'])
 if module=='stream':
  inp={'x':r.randint(0,100),'y':r.randint(0,100),'ignored':repeat}; got=stream_result(inp); exp=ref_stream(inp)
  if scenario=='steady': inp['ignored']+=1
  if scenario=='fault': inp['x']+=1
  if scenario=='recovery': inp['y']+=1
  expected_new=ref_stream(inp)
  reuse=expected_new==exp
  chosen=got if reuse else stream_result(inp)
  return chosen==expected_new
 if module=='state':
  state={'generation':2,'completed':set(),'uncertain':set()}; op=f'job-{repeat}'
  if scenario=='steady': state['completed'].add(op); decision='DENY_DUP'
  elif scenario=='burst':state['uncertain'].add(op);decision='HOLD_UNCERTAIN'
  elif scenario=='fault':decision='DENY_STALE' if 1<state['generation'] else 'ALLOW'
  else: decision='ALLOW' if op not in state['completed'] and op not in state['uncertain'] else 'DENY_DUP'
  return decision in ('DENY_DUP','HOLD_UNCERTAIN','DENY_STALE','ALLOW') and (scenario!='burst' or decision=='HOLD_UNCERTAIN')
 if module=='memory':
  cap=160; reservations=[]
  needs={'steady':[8]*10,'burst':[42]*10,'fault':[68,68,68,68],'recovery':[8,42,60,24,42]}[scenario]
  admitted=0;held=0
  for m in needs:
   if sum(reservations)+m<=cap-16:reservations.append(m);admitted+=1
   else:held+=1
  return sum(reservations)<=cap-16 and admitted+held==len(needs)
 if module=='serialization':
  b=bytes(r.getrandbits(8) for _ in range(1024 if scenario!='burst' else 4096)); v=memoryview(b); copy=bytes(bytearray(b));return hx(v)==hx(copy) and bytes(v)==copy
 if module=='replay':
  state={'generation':2,'seq':0,'seen':set()}; inputs={'steady':[(1,2,'A')], 'burst':[(1,2,'A'),(1,2,'A')],'fault':[(3,2,'B')], 'recovery':[(1,1,'old'),(1,2,'A')]}[scenario]
  accepted=0
  for seq,gen,ident in inputs:
   if gen!=state['generation'] or ident in state['seen'] or seq!=state['seq']+1:continue
   state['seen'].add(ident); state['seq']=seq;accepted+=1
  return accepted==1 if scenario!='fault' else accepted==0
 raise AssertionError(module)

def worker_rlimit(mib):
 import resource
 resource.setrlimit(resource.RLIMIT_AS,(mib*1024*1024,mib*1024*1024))
 try:
  b=bytearray(192*1024*1024)
  for i in range(0,len(b),4096):b[i]=1
  return 1
 except MemoryError:return 0

def main():
 p=argparse.ArgumentParser();p.add_argument('--output',default='');p.add_argument('--samples',type=int,default=N);a=p.parse_args()
 if a.samples<30:raise SystemExit('at least 30 repetitions are required')
 report={'schema':'ip-safe-g0-g7.reference-only.v1','environment':{'kernel':platform.release(),'system':platform.platform(),'python':sys.version.split()[0], 'hostname_excluded':True},'date_utc':datetime.datetime.now(datetime.timezone.utc).isoformat(),'seed':SEED,'repetitions':a.samples,'scope':'SYNTHETIC REFERENCE MODELS ONLY; no private native engine and no customer workload; no cgroup kernel OOM experiment','results':{},'gates':{},'notes':[]}
 raw=[];last='0'*64
 for module in MODULES:
  report['results'][module]={}
  for scenario in SCENARIOS:
   times=[];fail=0
   for rep in range(a.samples):
    start=time.perf_counter_ns();ok=eval_case(module,scenario,rep);el=time.perf_counter_ns()-start
    if not ok:fail+=1
    times.append(el)
    record={'module':module,'scenario':scenario,'rep':rep+1,'ok':ok,'ns':el,'prev_sha256':last}
    digest=hx(jbytes(record));record['entry_sha256']=digest;last=digest;raw.append(record)
   ordered=sorted(times)
   report['results'][module][scenario]={'passes':a.samples-fail,'trials':a.samples,'median_ns':round(statistics.median(times)),'p95_ns':ordered[int(.95*(len(ordered)-1))],'max_ns':max(times)}
  report['results'][module]['total_passes']=sum(report['results'][module][s]['passes'] for s in SCENARIOS)
  report['results'][module]['total_trials']=4*a.samples
 report['reference_trials']=len(raw)
 report['reference_passes']=sum(x['ok'] for x in raw)
 report['chain_head_sha256']=last
 report['gates']={'G0':'PASS_REFERENCE_CHAIN_ONLY','G1':'PASS_REFERENCE_ONLY','G2':'NOT_TESTED_PRIVATE_ENGINE_UNAVAILABLE','G3':'PASS_REFERENCE_SCALING_ONLY_NOT_PRODUCT','G4':'PASS_REFERENCE_NEGATIVE_FIXTURES_ONLY','G5':'NOT_TESTED_ACTIVE_OOMD_VPA_REAL_COMPETITORS','G6':'PASS_NO_SECRETS_SOURCE_IN_REPORT','G7':'NOT_DEMONSTRATED_REAL_ROI_ZERO_CLIENT_WORKLOADS'}
 if a.output:
  out=Path(a.output);out.mkdir(mode=0o700,parents=True,exist_ok=True)
  f=out/'reference_raw.jsonl';f.write_bytes(b''.join(jbytes(x)+b'\n' for x in raw));f.chmod(0o600)
  report['raw_file_sha256']=hx(f.read_bytes()); (out/'reference_summary.json').write_text(json.dumps(report,sort_keys=True,indent=2)+'\n');(out/'reference_summary.json').chmod(0o600)
 print(json.dumps({'environment_kernel':report['environment']['kernel'],'reference_trials':report['reference_trials'],'reference_passes':report['reference_passes'],'gates':report['gates'],'by_module':{k:(v['total_passes'],v['total_trials']) for k,v in report['results'].items()},'chain_head_sha256':report['chain_head_sha256'],'raw_file_sha256':report.get('raw_file_sha256'),'output':a.output}))
 if report['reference_passes']!=report['reference_trials']:raise SystemExit(2)
if __name__=='__main__':main()