#!/usr/bin/env python3
"""Build a fail-closed byte-replay ledger for all paired native artifacts."""

from __future__ import annotations

import argparse
import hashlib
import json
from pathlib import Path


def hashes(root: Path) -> dict[str, str]:
    return {
        path.relative_to(root).as_posix(): hashlib.sha256(path.read_bytes()).hexdigest()
        for path in sorted(root.rglob("*"))
        if path.is_file() and "__pycache__" not in path.parts
    }


def main() -> None:
    parser = argparse.ArgumentParser()
    parser.add_argument("--root", type=Path, default=Path("outputs"))
    parser.add_argument("--output", type=Path, required=True)
    args = parser.parse_args()
    train_a = hashes(args.root / "native_run_a")
    train_b = hashes(args.root / "native_run_b")
    oracle_a = hashes(args.root / "native_oracle_a")
    oracle_b = hashes(args.root / "native_oracle_b")
    linear_a = hashes(args.root / "linear_native_a")
    linear_b = hashes(args.root / "linear_native_b")
    result = {
        "paired_training_byte_identical": train_a == train_b,
        "paired_oracle_byte_identical": oracle_a == oracle_b,
        "paired_linear_byte_identical": linear_a == linear_b,
        "native_training_sha256": train_a,
        "native_oracle_sha256": oracle_a,
        "linear_training_sha256": linear_a,
    }
    result["all_paired_replays_pass"] = all(
        result[key]
        for key in (
            "paired_training_byte_identical",
            "paired_oracle_byte_identical",
            "paired_linear_byte_identical",
        )
    )
    if not result["all_paired_replays_pass"]:
        raise RuntimeError(f"paired artifact mismatch: {result}")
    args.output.write_text(
        json.dumps(result, indent=2, sort_keys=True) + "\n", encoding="utf-8"
    )
    print(json.dumps(result, indent=2, sort_keys=True))


if __name__ == "__main__":
    main()