src/memory/ledger.py

"""
Cryptographic Episodic Ledger — Vitalis FSI

High-performance, append-only, thread-safe, HMAC-signed memory ledger.
Uses line-delimited JSON (JSONL) to achieve O(1) append efficiency.
"""

from __future__ import annotations

import hashlib
import hmac
import json
import os
import secrets
import time
import fcntl
from dataclasses import dataclass, field
from pathlib import Path
from typing import List, Optional

from src.cognition._constants import BASE_DIR, logger
from src.cognition.serialization import VitalisEncoder

LEDGER_DIR = BASE_DIR / "ledger"
LEDGER_DIR.mkdir(parents=True, exist_ok=True)

KEY_FILE = LEDGER_DIR / ".vitalis_hmac.key"
if not KEY_FILE.exists():
    KEY_FILE.write_bytes(secrets.token_bytes(32))
HMAC_SECRET = KEY_FILE.read_bytes()

@dataclass(slots=True)
class LedgerBlock:
    index: int
    timestamp: float
    task_id: str
    outcome_metrics: str
    previous_hash: str
    block_hash: str = field(init=False)
    signature: str = field(init=False)

    def __post_init__(self) -> None:
        self.block_hash = self._calc_hash()
        self.signature = self._sign_hash()

    def _calc_hash(self) -> str:
        data = f"{self.index}|{self.timestamp:.6f}|{self.task_id}|{self.outcome_metrics}|{self.previous_hash}"
        return hashlib.sha256(data.encode("utf-8")).hexdigest()

    def _sign_hash(self) -> str:
        return hmac.new(HMAC_SECRET, self.block_hash.encode("utf-8"), hashlib.sha256).hexdigest()

    def is_valid(self) -> bool:
        if self.block_hash != self._calc_hash():
            return False
        expected = hmac.new(HMAC_SECRET, self.block_hash.encode("utf-8"), hashlib.sha256).hexdigest()
        return hmac.compare_digest(self.signature, expected)

class QuantumResistantLedger:
    """Streamlined append-only ledger processing system."""
    
    def __init__(self, ledger_file: str = "primary_chain.jsonl"):
        self.chain_path: Path = LEDGER_DIR / ledger_file
        self.chain: List[LedgerBlock] = []
        self._load_chain()

    def _load_chain(self) -> None:
        if not self.chain_path.exists():
            self._create_genesis_block()
            return

        with open(self.chain_path, "r", encoding="utf-8") as f:
            fcntl.flock(f.fileno(), fcntl.LOCK_SH)  # Shared read lock
            try:
                for line in f:
                    line = line.strip()
                    if not line:
                        continue
                    block_dict = json.loads(line)
                    block = LedgerBlock(
                        index=block_dict["index"],
                        timestamp=block_dict["timestamp"],
                        task_id=block_dict["task_id"],
                        outcome_metrics=block_dict["outcome_metrics"],
                        previous_hash=block_dict["previous_hash"],
                    )
                    block.block_hash = block_dict["block_hash"]
                    block.signature = block_dict.get("signature", "")
                    self.chain.append(block)
            finally:
                fcntl.flock(f.fileno(), fcntl.LOCK_UN)

        logger.debug("Ledger loaded – %d blocks parsed.", len(self.chain))

    def _create_genesis_block(self) -> None:
        genesis = LedgerBlock(
            index=0,
            timestamp=time.time(),
            task_id="GENESIS_0000",
            outcome_metrics="INITIALIZATION",
            previous_hash="0" * 64,
        )
        self.chain.append(genesis)
        
        # Initial write requires file generation
        with open(self.chain_path, "w", encoding="utf-8") as f:
            fcntl.flock(f.fileno(), fcntl.LOCK_EX)
            try:
                json_str = json.dumps(genesis, cls=VitalisEncoder, ensure_ascii=False)
                f.write(json_str + "\n")
            finally:
                fcntl.flock(f.fileno(), fcntl.LOCK_UN)
        logger.info("Genesis block synchronized successfully.")

    def append_record(self, task_id: str, outcome_metrics: str) -> LedgerBlock:
        """Appends a single ledger line in O(1) time without rewriting historical lines."""
        last = self.chain[-1]
        new_block = LedgerBlock(
            index=last.index + 1,
            timestamp=time.time(),
            task_id=task_id,
            outcome_metrics=outcome_metrics,
            previous_hash=last.block_hash,
        )
        
        json_str = json.dumps(new_block, cls=VitalisEncoder, ensure_ascii=False)
        
        # Open in append mode 'a' - will NOT truncate file before lock execution
        with open(self.chain_path, "a", encoding="utf-8") as f:
            fcntl.flock(f.fileno(), fcntl.LOCK_EX)
            try:
                f.write(json_str + "\n")
                f.flush()
                try:
                    os.fsync(f.fileno())
                except Exception:
                    pass
            finally:
                fcntl.flock(f.fileno(), fcntl.LOCK_UN)
                
        self.chain.append(new_block)
        logger.info("Ledger appended – block %d (task %s)", new_block.index, task_id)
        return new_block

    def verify_integrity(self) -> bool:
        """Validates chronological continuity and hardware hmac signatures."""
        for i in range(1, len(self.chain)):
            cur = self.chain[i]
            prev = self.chain[i - 1]

            if cur.previous_hash != prev.block_hash:
                logger.error("Ledger structural broken at block %d", i)
                return False
            if not cur.is_valid():
                logger.error("Signature invalid at block %d. Modification detected.", i)
                return False
        logger.info("Ledger integrity verified – %d blocks validated.", len(self.chain))
        return True

    def latest_block(self) -> LedgerBlock:
        return self.chain[-1]