import hashlib
import json
import os
import re
from pathlib import Path

ROOT = Path(__file__).resolve().parents[1]
PRIOR = ROOT.parent / '2026-11-01_icerti-web-media-analysis_r01'
os.umask(0o077)


def load(name):
    return json.loads((ROOT / 'private' / name).read_text(encoding='utf-8'))['data']


def sha(path):
    h = hashlib.sha256()
    with path.open('rb') as stream:
        for block in iter(lambda: stream.read(1024 * 1024), b''):
            h.update(block)
    return h.hexdigest()


before = load('protected_before.json')
after = load('protected_after.json')
preflight = load('preflight.json')
launch = load('launch_once.json')
removed = load('remove_launch_task.json')
readiness = load('readiness.json')
after_login = load('after_login.json')
human = json.loads((ROOT / 'user_confirmation.json').read_text(encoding='utf-8'))
prior_manifest = json.loads((PRIOR / 'manifest.json').read_text(encoding='utf-8'))
checks = {
    'prior_local_evidence_manifest_files_unchanged': all(sha(PRIOR / item['path']) == item['sha256'] for item in prior_manifest['files']),
    'nine_protected_windows_evidence_files_unchanged': sorted(before['evidence'], key=lambda x: x['name']) == sorted(after['evidence'], key=lambda x: x['name']),
    'chrome_pid_start_unchanged': before['chrome'] == after['chrome'],
    'nginx_pid_start_unchanged': before['nginx'] == after['nginx'],
    'containers_identity_image_start_restart_unchanged': preflight['containers'] == after['containers'],
    'os_boot_time_unchanged': preflight['last_boot'] == after['last_boot'],
    'one_media_process_in_existing_user_session': len(readiness['media']) == 1 and readiness['media'][0]['SessionId'] == 1,
    'temporary_task_removed_no_automatic_trigger': removed['verified_trigger_count'] == 0 and removed['task_absent'] and readiness['task_absent'],
    'same_media_process_after_user_login': len(after_login['media']) == 1 and after_login['media'][0]['Id'] == readiness['media'][0]['ProcessId'],
    'media_tcp_ports_bound_after_login': {x['LocalPort'] for x in after_login['listeners']} == {27000, 8555, 8888},
    'rtc_udp_bound_after_login': any(x['LocalPort'] == 8000 for x in after_login['rtc']),
}
assert all(checks.values()), checks
logs = readiness['stdout'] + '\n' + readiness['stderr']
blocked = [line for line in logs.splitlines() if 'INTROSPECTION_UNAVAILABLE' in line]
assert blocked, 'Readiness state changed; inspect before reporting.'
masked = re.sub(r'\b(?:https?|wss?|rtsps?)://\S+', '[ENDPOINT_REDACTED]', blocked[-1])
login_logs = after_login['stdout'] + '\n' + after_login['stderr']
ready_lines = [line for line in login_logs.splitlines() if 'media_control_ready serverId=REC-01' in line]
assert ready_lines, 'REC readiness was not established.'
admission = [line for line in login_logs.splitlines() if 'ai_command_admission camera=24 ' in line][-1]
ready_evidence = re.sub(r'\b(?:https?|wss?|rtsps?)://\S+', '[ENDPOINT_REDACTED]', ready_lines[-1])
summary = {
    'schema': 'icerti.media-recovery.v1', 'requested_at': launch['requested_at'],
    'launch_attempts': 1, 'process_id': readiness['media'][0]['ProcessId'],
    'media_app_running': True, 'media_control_port_listening': any(x['LocalPort'] == 27000 for x in readiness['listeners']),
    'rec_control_ready': True, 'camera24_video_verified': human['camera24_playback_confirmed_by_user'],
    'user_browser_verified': human['camera24_playback_confirmed_by_user'], 'browser_evidence_type': human['evidence_type'],
    'remaining': 'Crash root cause and persistent SSH are separate follow-ups. No further channel checks after human playback confirmation.',
    'login_required_before_user_action': masked, 'ready_after_user_login': ready_evidence,
    'last_machine_admission_before_human_confirmation': admission, 'checks': checks,
    'new_persistent_startup_or_ssh_setting': False,
    'task_trigger_count_note': 'The first PowerShell @($null).Count field is not an actual trigger count; exported task XML verified zero triggers before removal.',
}
(ROOT / 'verification.json').write_text(json.dumps(summary, ensure_ascii=False, indent=2) + '\n', encoding='utf-8')
print(json.dumps(summary, ensure_ascii=False))