import os
from pathlib import Path
import subprocess
import sys

os.umask(0o077)
root = Path(__file__).parent
mode = sys.argv[1] if len(sys.argv) > 1 else 'first'
assert mode in ('first', 'final', 'finish', 'sdk-diagnostic', 'sdk-fix')
name = 'codex-metadata-connect-r01'
args = ['docker', 'run', '--rm', '--pull', 'never', '--runtime', 'runc', '--network', 'none',
        '--name', name, '--cap-drop', 'MKNOD', '--cpus', '2', '--memory', '4g', '--ulimit', 'core=0',
        '-e', 'NVIDIA_VISIBLE_DEVICES=void', '-e', 'PYTHONDONTWRITEBYTECODE=1',
        '-e', 'PYTHONPATH=/source:/opt/contextra',
        '-e', 'LD_LIBRARY_PATH=/driver:/opt/nvidia/deepstream/deepstream/lib:/opt/contextra/lib',
        '--mount', 'type=bind,src=/usr/lib/x86_64-linux-gnu/libcuda.so.595.84,dst=/driver/libcuda.so.1,readonly',
        '--mount', 'type=bind,src=/tmp/codex/ltb1021/2026-09-11_contextra-frame-abi_r01/build/fixture.so,dst=/fixture.so,readonly',
        '--mount', 'type=bind,src=/workspace/contextra-analytics-runtime-lifecycle-refactor,dst=/source,readonly',
        '--mount', f'type=bind,src={root},dst=/evidence', '-w', '/source', '--entrypoint', 'timeout',
        'contextra-analytics:metadata-4bdf50c-b165320b', '150s', 'python3', '/evidence/verify.py', mode]
try:
    result = subprocess.run(args, capture_output=True, text=True, timeout=180)
    (root/(mode+'-console.log')).write_text(result.stdout + result.stderr)
    print(result.stdout[-1500:])
    raise SystemExit(result.returncode)
finally:
    alive = subprocess.run(['docker', 'inspect', name], capture_output=True, timeout=10)
    if alive.returncode == 0:
        subprocess.run(['docker', 'stop', '--timeout', '5', name], capture_output=True, check=True, timeout=15)