import hashlib
import json
import os
from pathlib import Path

ROOT = Path(__file__).resolve().parents[1]
RECOVERY = ROOT.parent / '2026-11-01_icerti-web-media-recovery_r01'
os.umask(0o077)


def load(root, name):
    return json.loads((root / 'private' / name).read_text(encoding='utf-8'))['data']


def file_sha(path):
    h = hashlib.sha256()
    with path.open('rb') as stream:
        for block in iter(lambda: stream.read(1024 * 1024), b''):
            h.update(block)
    return h.hexdigest()


state = load(ROOT, 'install_state.json')
ssh = load(ROOT, 'ssh_state.json')
protected = load(ROOT, 'protected_state.json')
prior = load(RECOVERY, 'protected_after.json')
prior_media = load(RECOVERY, 'after_login.json')['media'][0]
checks = {
    'read_only_admin_ssh_succeeded': state['administrator'],
    'host_key_matches_pinned_identity': 'SHA256:accTHqAmi4P5DSvaxMiuM+TzoTK4Y2Px+ilsA+pKVtE' in ssh['host_public_fingerprint'],
    'expected_temporary_ssh_listener': len(ssh['listeners']) == 1 and ssh['listeners'][0]['OwningProcess'] == 43920,
    'password_authentication_disabled': 'PasswordAuthentication no' in ssh['config'],
    'public_key_authentication_required': 'AuthenticationMethods publickey' in ssh['config'],
    'forwarding_disabled': 'DisableForwarding yes' in ssh['config'],
    'single_existing_source_restriction': ssh['addresses'] == [{'LocalAddress': '192.168.30.18', 'RemoteAddress': '192.168.30.52'}],
    'preserved_nine_files_unchanged': protected['evidence'] == prior['evidence'] and len(protected['evidence']) == 9,
    'chrome_pid_start_unchanged': protected['chrome'] == prior['chrome'],
    'nginx_pid_start_unchanged': protected['nginx'] == prior['nginx'],
    'containers_identity_image_start_unchanged': protected['containers'] == prior['containers'],
    'os_boot_time_unchanged': protected['last_boot'] == prior['last_boot'],
    'same_media_process': len(protected['media']) == 1 and protected['media'][0]['Id'] == prior_media['Id'] and protected['media'][0]['started'] == prior_media['started'],
}
for name in ('2026-11-01_icerti-web-media-analysis_r01', '2026-11-01_icerti-web-media-recovery_r01'):
    folder = ROOT.parent / name
    manifest = json.loads((folder / 'manifest.json').read_text(encoding='utf-8'))
    checks[name + '_manifest_unchanged'] = all(file_sha(folder / item['path']) == item['sha256'] for item in manifest['files'])
assert all(checks.values()), checks
assert state['capability'][0]['state'] == 'InstallPending'
assert state['cbs_reboot_pending'] and state['cbs_packages_pending'] and state['update_reboot_required']
assert not any(s['Name'] == 'sshd' for s in state['services'])
assert all(not f['exists'] for f in state['files'])
summary = {
    'schema': 'icerti.ssh-service-preflight.v1', 'status': 'STOPPED_AT_REBOOT_BOUNDARY',
    'capability_state': 'InstallPending',
    'cbs_reboot_pending': True, 'cbs_packages_pending': True, 'windows_update_reboot_required': True,
    'inbox_sshd_binary_present': False, 'standard_sshd_service_present': False,
    'temporary_ssh_retained': True, 'service_transition_performed': False,
    'runtime_or_security_configuration_writes': 0, 'checks': checks,
    'not_tested': ['service automatic startup', 'service restart and fresh connection', 'before-login/reboot behavior'],
    'next': 'User-authorized maintenance reboot and follow-up actual installation/service/firewall check; do not force-clear pending state or silently promote Preview.',
}
(ROOT / 'verification.json').write_text(json.dumps(summary, ensure_ascii=False, indent=2) + '\n', encoding='utf-8')
print(json.dumps({'status': summary['status'], 'checks_passed': len(checks), 'runtime_or_security_configuration_writes': 0}))