from __future__ import annotations

import json
from pathlib import Path

ROOT = Path(__file__).resolve().parents[1]
REPORT_DIR = ROOT / "docs" / "reports" / "leo-working-state-20260709"
MANIFEST = REPORT_DIR / "skill-pack-manifest.json"


def _skill(name: str) -> str:
    return (ROOT / ".agents" / "skills" / name / "SKILL.md").read_text(encoding="utf-8")


def test_manifest_indexes_valid_repo_native_skills() -> None:
    manifest = json.loads(MANIFEST.read_text(encoding="utf-8"))

    assert manifest["status"] == "repo_native_validated"
    assert manifest["repo_skill_root"] == ".agents/skills"
    assert manifest["validation"] == "tests/test_repo_skill_pack.py"
    assert "37/37" in manifest["claim_ceiling"]
    assert "auto-synchronized" in manifest["claim_ceiling"]
    assert "apply worker remained disabled/inactive" in manifest["claim_ceiling"]

    for entry in manifest["skills"]:
        path = ROOT / entry["path"]
        text = path.read_text(encoding="utf-8")
        assert path.is_file()
        assert text.startswith("---\n")
        assert f"name: {entry['name']}\n" in text.split("---\n", 2)[1]
        assert "description:" in text.split("---\n", 2)[1]

    for relative in manifest["reference_files"]:
        assert (ROOT / relative).is_file(), relative


def test_db_change_skill_tracks_guarded_v2_runtime_proof() -> None:
    text = _skill("teleo-kb-db-change-workflow")
    squashed = " ".join(text.split())

    for required in (
        "`approve_claim` v2",
        "kb_review",
        "kb_apply",
        "kb_gate_owner",
        "NOINHERIT",
        "37/37",
        "exact table deltas",
        "source hashes",
        "trusted operator-only canonical writer",
        "run_approve_claim_isolated_container_canary.sh",
        "all `13` checks",
        "`34/34`",
        "PR #86",
    ):
        assert required in text

    assert "Production was not applied" in squashed
    assert "Arbitrary production document/tweet ingestion is not proven" in squashed
    assert "three approved-but-unapplied legacy packets" in squashed


def test_gcp_skill_uses_current_operator_access_and_parity_truth() -> None:
    text = _skill("teleo-gcp-parity-ops")
    squashed = " ".join(text.split())

    for required in (
        "ssh teleo-gcp-staging",
        "teleo-pgvector-standby",
        "PostgreSQL 16.14",
        "public IP disabled",
        "39/39",
        "52,167/52,167",
        "`148735`, `NRestarts=0`",
        "NRestarts=0",
        "state.db",
        "leoclean-cloudsql-memory-sync.service",
        "gcp-db-first-restore-current.json",
        "gcp-db-first-parity-current.json",
        "gcp-db-first-blind-claim-current.json",
        "gcp-db-first-cleanup-current.json",
        "18/18",
        "6/6",
        "invalid_target",
        "older staging copy",
    ):
        assert required in text

    assert "does not store a Google password" in squashed
    assert "firewall-source-dependent" in text
    assert "Do not call this path working until a live `status` run passes" in text
    assert "Do not describe a passing Hermes memory sync as canonical KB parity" in text
    assert "Do not call control-plane inventory" in text


def test_vps_onboarding_and_m3taversal_skills_point_to_current_proof() -> None:
    vps = _skill("teleo-vps-runtime-ops")
    provenance = _skill("teleo-infra-provenance")
    onboarding = _skill("teleo-leo-onboarding")
    outcomes = _skill("working-leo-m3taversal-outcomes")

    assert "reasoning tools `17`" in vps
    assert "current source hashes" in vps
    assert "`teleo-auto-deploy.timer`" in vps
    assert "separate state changes" in vps
    assert "/opt/teleo-eval/.last-deploy-sha" in provenance
    assert "does not prove a gateway restart" in " ".join(provenance.split())
    assert "gcp-cloud-sql-t3-live-readonly-current.md" in onboarding
    assert "gcp-db-first-working-leo-20260714.md" in onboarding
    assert "gcp-db-first-parity-current.json" in onboarding
    assert "gcp-db-first-blind-claim-current.json" in onboarding
    assert "gcp-db-first-cleanup-current.json" in onboarding
    assert "ssh -o BatchMode=yes teleo-gcp-staging true" in onboarding
    assert "37/37" in outcomes
    assert "Approved is not the same as applied" in outcomes
    assert "Address `@m3taversal` only as `m3taversal`, exactly" in outcomes
    assert "Next proof-changing follow-up:" in outcomes
    assert "working-leo-current-proof-20260712.md" in outcomes
    assert "Cory" not in outcomes
