from __future__ import annotations

import argparse
import copy
import hashlib
import json
import shutil
import stat
import subprocess
import sys
import time
import uuid
from collections.abc import Iterator
from pathlib import Path

import pytest

from ops import run_local_genesis_ledger_rebuild as rebuild

CLAIM_A = "aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa"
CLAIM_B = "bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb"
REVIEWER_ID = "11111111-1111-4111-8111-111111111111"
SERVICE_ID = "44444444-4444-4444-4444-444444444444"
PROPOSAL_ID = "99999999-9999-4999-8999-999999999999"
EDGE_ID = "eeeeeeee-eeee-4eee-8eee-eeeeeeeeeeee"
PRIVATE_MARKER = "PRIVATE-REPLAY-MATERIAL-MUST-NOT-LEAK"


def sha256_file(path: Path) -> str:
    digest = hashlib.sha256()
    digest.update(path.read_bytes())
    return digest.hexdigest()


def write_json(path: Path, value: object) -> Path:
    path.write_text(json.dumps(value, indent=2, sort_keys=True) + "\n", encoding="utf-8")
    return path


def manifest_rows(database: str = "teleo_fixture") -> list[dict]:
    role = {
        "name": "kb_apply",
        "can_login": True,
        "superuser": False,
        "create_db": False,
        "create_role": False,
        "inherit": False,
        "replication": False,
        "bypass_rls": False,
    }
    rows = [
        {
            "kind": "identity",
            "database": database,
            "server_version_num": 160010,
            "transaction_read_only": "on",
            "server_address": None,
            "server_port": None,
            "ssl": False,
            "ssl_version": None,
            "database_collation": "C",
            "database_ctype": "C",
        },
        {"kind": "schemas", "items": ["kb_stage", "public"]},
        {"kind": "extensions", "items": []},
        {"kind": "application_roles", "items": [role]},
    ]
    rows.extend(
        {"kind": kind, "items": []}
        for kind in (
            "columns",
            "constraints",
            "indexes",
            "sequences",
            "views",
            "functions",
            "triggers",
            "types",
            "policies",
        )
    )
    rows.extend(
        [
            {
                "kind": "table",
                "schema": "public",
                "table": "claims",
                "row_count": 2,
                "rowset_md5": "fixture",
            },
            {
                "kind": "performance",
                "query": "count_claims",
                "elapsed_ms": 1.0,
                "observed_rows": 2,
            },
        ]
    )
    return rows


def write_manifest(path: Path) -> Path:
    path.write_text("".join(json.dumps(row) + "\n" for row in manifest_rows()), encoding="utf-8")
    return path


def proposal_rows() -> tuple[dict, dict, dict]:
    payload = {
        "apply_payload": {
            "from_claim": CLAIM_A,
            "to_claim": CLAIM_B,
            "edge_type": "supports",
            "weight": 0.8,
        },
        "private_title": PRIVATE_MARKER,
    }
    approved = {
        "id": PROPOSAL_ID,
        "proposal_type": "add_edge",
        "status": "approved",
        "proposed_by_handle": "fixture-agent",
        "proposed_by_agent_id": REVIEWER_ID,
        "channel": "reconstruction_fixture",
        "source_ref": "private://fixture/source",
        "rationale": PRIVATE_MARKER,
        "payload": payload,
        "reviewed_by_handle": "m3ta",
        "reviewed_by_agent_id": REVIEWER_ID,
        "reviewed_at": "2026-07-14T01:00:00+00:00",
        "review_note": "Reviewed exact strict fixture payload.",
        "applied_by_handle": None,
        "applied_by_agent_id": None,
        "applied_at": None,
        "created_at": "2026-07-14T00:59:00+00:00",
        "updated_at": "2026-07-14T01:00:00+00:00",
    }
    applied = {
        **approved,
        "status": "applied",
        "applied_by_handle": "kb-apply",
        "applied_by_agent_id": SERVICE_ID,
        "applied_at": "2026-07-14T01:01:00+00:00",
        "updated_at": "2026-07-14T01:01:00.000001+00:00",
    }
    approval = {
        "proposal_id": PROPOSAL_ID,
        "proposal_type": "add_edge",
        "payload": payload,
        "reviewed_by_handle": "m3ta",
        "reviewed_by_agent_id": REVIEWER_ID,
        "reviewed_by_db_role": "kb_review",
        "reviewed_at": "2026-07-14T01:00:00+00:00",
        "review_note": "Reviewed exact strict fixture payload.",
    }
    return approved, applied, approval


def applied_envelope(applied: dict) -> dict:
    fields = (
        "id",
        "proposal_type",
        "status",
        "payload",
        "reviewed_by_handle",
        "reviewed_by_agent_id",
        "reviewed_at",
        "review_note",
        "applied_by_handle",
        "applied_by_agent_id",
        "applied_at",
    )
    return {field: applied[field] for field in fields}


def replay_material() -> dict:
    approved, applied, approval = proposal_rows()
    proposal = applied_envelope(applied)
    edge = {
        "id": EDGE_ID,
        "from_claim": CLAIM_A,
        "to_claim": CLAIM_B,
        "edge_type": "supports",
        "weight": 0.8,
        "created_by": None,
        "created_at": "2026-07-14T01:00:30+00:00",
    }
    receipt = rebuild.replay_receipt.build_replay_receipt(
        proposal,
        {"claim_edges": [edge]},
        apply_sql_sha256=rebuild.replay_receipt.sha256_text("fixture original guarded apply SQL"),
        apply_sql_source="exact_executed_sql",
        exported_at_utc="2026-07-14T01:02:00+00:00",
    )
    return {
        "artifact": rebuild.MATERIAL_ARTIFACT,
        "contract_version": rebuild.MATERIAL_CONTRACT_VERSION,
        "sequence": 1,
        "approved_proposal": approved,
        "approval_snapshot": approval,
        "applied_proposal": applied,
        "replay_receipt": receipt,
    }


def write_bundle(tmp_path: Path, *, material: dict | None = None) -> argparse.Namespace:
    dump = tmp_path / "genesis.dump"
    dump.write_bytes(b"PGDMPfixture")
    genesis_manifest = write_manifest(tmp_path / "genesis-manifest.jsonl")
    final_manifest = write_manifest(tmp_path / "final-manifest.jsonl")
    material = copy.deepcopy(material or replay_material())
    material_path = write_json(tmp_path / "entry-0001.json", material)
    receipt_hash = material["replay_receipt"]["hashes"]["replay_material_sha256"]
    ledger = {
        "artifact": rebuild.LEDGER_ARTIFACT,
        "contract_version": rebuild.LEDGER_CONTRACT_VERSION,
        "engine": rebuild._engine_hashes(),
        "genesis": {
            "dump_sha256": sha256_file(dump),
            "parity_manifest_sha256": sha256_file(genesis_manifest),
        },
        "entries": [
            {
                "sequence": 1,
                "material": material_path.name,
                "sha256": sha256_file(material_path),
                "replay_material_sha256": receipt_hash,
            }
        ],
        "final_parity": {
            "manifest": final_manifest.name,
            "sha256": sha256_file(final_manifest),
        },
    }
    ledger_path = write_json(tmp_path / "ledger.json", ledger)
    return argparse.Namespace(
        genesis_dump=dump,
        genesis_manifest=genesis_manifest,
        ledger=ledger_path,
        ledger_sha256=sha256_file(ledger_path),
        database="teleo",
        image=rebuild.canonical_rebuild.DEFAULT_IMAGE,
        container_prefix="teleo-genesis-ledger-test",
        tmpfs_mb=256,
        startup_timeout=30.0,
        restore_timeout=60.0,
        apply_timeout=60.0,
        manifest_timeout=60.0,
        command_timeout=20.0,
        poll_interval=0.05,
        max_target_query_ms=5000.0,
        max_target_source_ratio=100.0,
        docker_bin="docker",
        output=tmp_path / "receipt.json",
    )


def rewrite_material_and_ledger(args: argparse.Namespace, material: dict) -> None:
    material_path = args.ledger.parent / "entry-0001.json"
    write_json(material_path, material)
    ledger = json.loads(args.ledger.read_text(encoding="utf-8"))
    ledger["entries"][0]["sha256"] = sha256_file(material_path)
    write_json(args.ledger, ledger)
    args.ledger_sha256 = sha256_file(args.ledger)


def test_load_bundle_validates_every_pin_and_current_apply_engine(tmp_path: Path) -> None:
    args = write_bundle(tmp_path)

    bundle = rebuild.load_bundle(args)

    assert bundle.genesis_dump_sha256 == sha256_file(args.genesis_dump)
    assert bundle.genesis_manifest_sha256 == sha256_file(args.genesis_manifest)
    assert bundle.final_manifest_sha256 == sha256_file(tmp_path / "final-manifest.jsonl")
    assert bundle.engine_hashes == rebuild._engine_hashes()
    assert len(bundle.entries) == 1
    entry = bundle.entries[0]
    assert entry.applied_proposal["proposal_type"] == "add_edge"
    assert entry.current_apply_sql_sha256 == hashlib.sha256(entry.current_apply_sql.encode("utf-8")).hexdigest()
    assert "kb_stage.assert_approved_proposal" in entry.current_apply_sql


def test_dump_hash_mismatch_fails_before_container_start(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
    args = write_bundle(tmp_path)
    args.genesis_dump.write_bytes(b"PGDMPtampered")
    commands: list[list[str]] = []

    def absent_docker(command: list[str], *, timeout: float):
        commands.append(command)
        if command[1:3] == ["rm", "--force"]:
            return subprocess.CompletedProcess(command, 1, "", "No such container")
        if command[1:3] == ["container", "inspect"]:
            return subprocess.CompletedProcess(command, 1, "", "No such object")
        raise AssertionError(f"unexpected command after failed preflight: {command}")

    monkeypatch.setattr(rebuild.canonical_rebuild, "_run", absent_docker)

    receipt = rebuild.run_reconstruction(args)

    assert receipt["status"] == "fail"
    assert receipt["error"]["code"] == "hash_pin_mismatch"
    assert receipt["cleanup"]["container_absent"] is True
    assert not any(len(command) > 1 and command[1] == "run" for command in commands)


def test_revise_strategy_receipt_fails_closed_before_receipt_rows_are_used(tmp_path: Path) -> None:
    material = replay_material()
    material["replay_receipt"]["proposal"]["proposal_type"] = "revise_strategy"
    material["applied_proposal"]["proposal_type"] = "revise_strategy"
    material["approved_proposal"]["proposal_type"] = "revise_strategy"
    material["approval_snapshot"]["proposal_type"] = "revise_strategy"
    args = write_bundle(tmp_path, material=material)

    with pytest.raises(rebuild.ReconstructionError, match="prior strategy") as exc_info:
        rebuild.load_bundle(args)

    assert exc_info.value.code == "unsupported_mutating_receipt"


def test_legacy_freeform_receipt_fails_closed(tmp_path: Path) -> None:
    material = replay_material()
    material["replay_receipt"]["proposal"]["payload"] = {"legacy": PRIVATE_MARKER}
    material["approved_proposal"]["payload"] = {"legacy": PRIVATE_MARKER}
    material["applied_proposal"]["payload"] = {"legacy": PRIVATE_MARKER}
    material["approval_snapshot"]["payload"] = {"legacy": PRIVATE_MARKER}
    args = write_bundle(tmp_path, material=material)

    with pytest.raises(rebuild.ReconstructionError) as exc_info:
        rebuild.load_bundle(args)

    assert exc_info.value.code == "invalid_replay_receipt"
    assert PRIVATE_MARKER not in exc_info.value.safe_message


def test_proposal_metadata_outside_apply_transition_is_rejected(tmp_path: Path) -> None:
    material = replay_material()
    material["applied_proposal"]["rationale"] = "silently changed after review"
    args = write_bundle(tmp_path)
    rewrite_material_and_ledger(args, material)

    with pytest.raises(rebuild.ReconstructionError) as exc_info:
        rebuild.load_bundle(args)

    assert exc_info.value.code == "material_mismatch"
    assert "rationale" in exc_info.value.safe_message


def test_output_cannot_overwrite_a_fixed_guard_or_engine_file(tmp_path: Path) -> None:
    args = write_bundle(tmp_path)
    args.output = rebuild.GUARD_PREREQUISITES_PATH

    with pytest.raises(rebuild.ReconstructionError) as exc_info:
        rebuild.load_bundle(args)

    assert exc_info.value.code == "unsafe_output_path"


def test_unknown_private_field_name_is_not_echoed_in_public_error(tmp_path: Path) -> None:
    material = replay_material()
    material[PRIVATE_MARKER] = "private value"
    args = write_bundle(tmp_path, material=material)

    with pytest.raises(rebuild.ReconstructionError) as exc_info:
        rebuild.load_bundle(args)

    assert exc_info.value.code == "invalid_contract"
    assert PRIVATE_MARKER not in exc_info.value.safe_message


def test_seed_sql_preserves_exact_rows_and_uses_only_fixed_tables(tmp_path: Path) -> None:
    entry = rebuild.load_bundle(write_bundle(tmp_path)).entries[0]

    sql = rebuild.build_seed_sql(entry)

    assert "jsonb_populate_record" in sql
    assert "kb_stage.kb_proposals" in sql
    assert "kb_stage.kb_proposal_approvals" in sql
    assert "public.claim_edges" in sql
    assert "on conflict do nothing" in sql
    assert PRIVATE_MARKER in sql
    assert "public.strategies" not in sql


def test_private_psql_failure_output_is_replaced_with_a_fingerprint(
    monkeypatch: pytest.MonkeyPatch,
) -> None:
    captured: dict[str, object] = {}

    def fail(command: list[str], *, stdin: str, timeout: float):
        captured.update(command=command, stdin=stdin, timeout=timeout)
        return subprocess.CompletedProcess(command, 1, "", f"ERROR: {PRIVATE_MARKER}")

    monkeypatch.setattr(rebuild, "_run_stdin", fail)
    args = argparse.Namespace(docker_bin="docker", database="teleo")

    with pytest.raises(rebuild.ReconstructionError) as exc_info:
        rebuild._psql(
            args,
            "fixture-container",
            f"select '{PRIVATE_MARKER}';",
            role="postgres",
            timeout=3.0,
            code="fixture_failure",
            action="private fixture SQL",
        )

    assert PRIVATE_MARKER not in exc_info.value.safe_message
    assert "diagnostic_sha256=" in exc_info.value.safe_message
    assert PRIVATE_MARKER not in " ".join(captured["command"])
    assert PRIVATE_MARKER in captured["stdin"]


def test_entry_summary_is_secret_safe(tmp_path: Path) -> None:
    entry = rebuild.load_bundle(write_bundle(tmp_path)).entries[0]

    encoded = json.dumps(rebuild._entry_summary(entry), sort_keys=True)

    assert PRIVATE_MARKER not in encoded
    assert entry.applied_proposal["id"] in encoded
    assert entry.replay_material_sha256 in encoded


BOOTSTRAP_SQL = f"""
create role kb_apply login noinherit;
create role kb_review login noinherit;
create schema kb_stage;
create type evidence_role as enum ('grounds', 'illustrates', 'contradicts');
create type edge_type as enum (
  'supports', 'challenges', 'requires', 'relates', 'contradicts', 'supersedes',
  'derives_from', 'cites', 'causes', 'constrains', 'accelerates'
);

create table public.agents (
  id uuid primary key,
  handle text not null unique,
  kind text not null
);
create table public.claims (
  id uuid primary key,
  type text not null,
  text text not null,
  status text not null,
  confidence numeric,
  tags text[] not null default '{{}}',
  created_by uuid references public.agents(id),
  superseded_by uuid references public.claims(id),
  created_at timestamptz not null default now(),
  updated_at timestamptz not null default now()
);
create table public.sources (
  id uuid primary key,
  source_type text not null,
  url text,
  storage_path text,
  excerpt text,
  hash text not null,
  created_by uuid references public.agents(id),
  captured_at timestamptz,
  created_at timestamptz not null default now()
);
create table public.claim_evidence (
  id uuid primary key,
  claim_id uuid not null references public.claims(id),
  source_id uuid not null references public.sources(id),
  role evidence_role not null,
  weight numeric,
  created_by uuid references public.agents(id),
  created_at timestamptz not null default now()
);
create table public.claim_edges (
  id uuid primary key,
  from_claim uuid not null references public.claims(id),
  to_claim uuid not null references public.claims(id),
  edge_type edge_type not null,
  weight numeric,
  created_by uuid references public.agents(id),
  created_at timestamptz not null default now()
);
create table public.reasoning_tools (
  id uuid primary key,
  agent_id uuid references public.agents(id),
  name text not null,
  description text not null,
  category text,
  created_at timestamptz not null default now()
);
create table public.strategies (
  id uuid primary key,
  agent_id uuid not null references public.agents(id),
  diagnosis text,
  guiding_policy text,
  proximate_objectives jsonb,
  version integer not null default 1,
  active boolean not null default true,
  created_at timestamptz not null default now()
);
create table public.strategy_nodes (
  id uuid primary key,
  agent_id uuid references public.agents(id),
  node_type text,
  title text,
  body text,
  rank integer,
  status text not null default 'active',
  horizon text,
  measure text,
  source_ref text,
  metadata jsonb not null default '{{}}',
  created_at timestamptz not null default now(),
  updated_at timestamptz not null default now()
);
create table kb_stage.kb_proposals (
  id uuid primary key,
  proposal_type text not null,
  status text not null,
  proposed_by_handle text,
  proposed_by_agent_id uuid references public.agents(id),
  channel text,
  source_ref text,
  rationale text,
  payload jsonb not null,
  reviewed_by_handle text,
  reviewed_by_agent_id uuid references public.agents(id),
  reviewed_at timestamptz,
  review_note text,
  applied_by_handle text,
  applied_by_agent_id uuid references public.agents(id),
  applied_at timestamptz,
  created_at timestamptz not null default now(),
  updated_at timestamptz not null default now()
);

insert into public.agents (id, handle, kind) values
  ('{REVIEWER_ID}', 'm3ta', 'human');
insert into public.claims (id, type, text, status, confidence, tags, created_by) values
  ('{CLAIM_A}', 'structural', 'Fixture claim A', 'open', 0.8, array['fixture'], '{REVIEWER_ID}'),
  ('{CLAIM_B}', 'structural', 'Fixture claim B', 'open', 0.8, array['fixture'], '{REVIEWER_ID}');
"""


def docker_psql(
    container: str,
    database: str,
    sql: str,
    *,
    role: str = "postgres",
    check: bool = True,
) -> subprocess.CompletedProcess[str]:
    completed = subprocess.run(
        [
            "docker",
            "exec",
            "-i",
            container,
            "psql",
            "-X",
            "-U",
            role,
            "-h",
            "127.0.0.1",
            "-d",
            database,
            "-Atq",
            "-v",
            "ON_ERROR_STOP=1",
        ],
        input=sql,
        text=True,
        capture_output=True,
        check=False,
    )
    if check and completed.returncode != 0:
        pytest.fail(
            f"fixture psql failed ({completed.returncode})\nstdout:\n{completed.stdout}\nstderr:\n{completed.stderr}"
        )
    return completed


def wait_for_postgres(container: str, database: str) -> None:
    for _ in range(120):
        completed = docker_psql(container, database, "select 1;", check=False)
        if completed.returncode == 0:
            return
        time.sleep(0.25)
    pytest.fail("fixture PostgreSQL did not become ready")


def capture_manifest(container: str, database: str, destination: Path) -> None:
    copy_result = subprocess.run(
        ["docker", "cp", str(rebuild.PARITY_SQL_PATH), f"{container}:/tmp/parity.sql"],
        text=True,
        capture_output=True,
        check=False,
    )
    if copy_result.returncode != 0:
        pytest.fail(f"could not copy parity SQL: {copy_result.stderr}")
    completed = subprocess.run(
        [
            "docker",
            "exec",
            container,
            "psql",
            "-X",
            "-U",
            "postgres",
            "-d",
            database,
            "-Atq",
            "-v",
            "ON_ERROR_STOP=1",
            "-f",
            "/tmp/parity.sql",
        ],
        text=True,
        capture_output=True,
        check=False,
    )
    if completed.returncode != 0:
        pytest.fail(f"could not capture parity manifest: {completed.stderr}")
    destination.write_text(completed.stdout, encoding="utf-8")


@pytest.fixture(scope="module")
def source_postgres() -> Iterator[tuple[str, str]]:
    if shutil.which("docker") is None:
        pytest.skip("Docker is required for the genesis-plus-ledger lifecycle test")
    container = f"genesis-ledger-source-{uuid.uuid4().hex[:12]}"
    database = "teleo_fixture"
    started = subprocess.run(
        [
            "docker",
            "run",
            "--rm",
            "--detach",
            "--name",
            container,
            "--env",
            f"POSTGRES_DB={database}",
            "--env",
            "POSTGRES_HOST_AUTH_METHOD=trust",
            rebuild.canonical_rebuild.DEFAULT_IMAGE,
        ],
        text=True,
        capture_output=True,
        check=False,
    )
    if started.returncode != 0:
        pytest.fail(f"could not start fixture PostgreSQL: {started.stderr}")
    try:
        wait_for_postgres(container, database)
        docker_psql(container, database, BOOTSTRAP_SQL)
        copy_result = subprocess.run(
            [
                "docker",
                "cp",
                str(rebuild.GUARD_PREREQUISITES_PATH),
                f"{container}:/tmp/kb-apply-prereqs.sql",
            ],
            text=True,
            capture_output=True,
            check=False,
        )
        if copy_result.returncode != 0:
            pytest.fail(f"could not copy apply prerequisites: {copy_result.stderr}")
        migration = subprocess.run(
            [
                "docker",
                "exec",
                container,
                "psql",
                "-X",
                "-U",
                "postgres",
                "-d",
                database,
                "-Atq",
                "-v",
                "ON_ERROR_STOP=1",
                "-f",
                "/tmp/kb-apply-prereqs.sql",
            ],
            text=True,
            capture_output=True,
            check=False,
        )
        if migration.returncode != 0:
            pytest.fail(f"could not apply guarded prerequisites: {migration.stderr}")
        yield container, database
    finally:
        subprocess.run(
            ["docker", "rm", "--force", container],
            text=True,
            capture_output=True,
            check=False,
        )


def test_live_genesis_plus_ledger_command_rebuilds_exactly_and_proves_cleanup(
    tmp_path: Path,
    source_postgres: tuple[str, str],
) -> None:
    source_container, database = source_postgres
    genesis_dump = tmp_path / "genesis.dump"
    dump_result = subprocess.run(
        [
            "docker",
            "exec",
            source_container,
            "pg_dump",
            "-U",
            "postgres",
            "-d",
            database,
            "--format=custom",
            "--file=/tmp/genesis.dump",
        ],
        text=True,
        capture_output=True,
        check=False,
    )
    assert dump_result.returncode == 0, dump_result.stderr
    copy_result = subprocess.run(
        ["docker", "cp", f"{source_container}:/tmp/genesis.dump", str(genesis_dump)],
        text=True,
        capture_output=True,
        check=False,
    )
    assert copy_result.returncode == 0, copy_result.stderr

    genesis_manifest = tmp_path / "genesis-manifest.jsonl"
    capture_manifest(source_container, database, genesis_manifest)

    material = replay_material()
    material_path = write_json(tmp_path / "entry-0001.json", material)
    entry = rebuild._validate_entry_material(
        material,
        expected_sequence=1,
        expected_replay_hash=material["replay_receipt"]["hashes"]["replay_material_sha256"],
        material_path=material_path,
        material_sha256=sha256_file(material_path),
    )
    docker_psql(source_container, database, rebuild.build_seed_sql(entry))
    docker_psql(
        source_container,
        database,
        entry.current_apply_sql,
        role="kb_apply",
    )
    docker_psql(
        source_container,
        database,
        rebuild.build_applied_timestamp_normalization_sql(entry),
    )

    final_manifest = tmp_path / "final-manifest.jsonl"
    capture_manifest(source_container, database, final_manifest)
    ledger = {
        "artifact": rebuild.LEDGER_ARTIFACT,
        "contract_version": rebuild.LEDGER_CONTRACT_VERSION,
        "engine": rebuild._engine_hashes(),
        "genesis": {
            "dump_sha256": sha256_file(genesis_dump),
            "parity_manifest_sha256": sha256_file(genesis_manifest),
        },
        "entries": [
            {
                "sequence": 1,
                "material": material_path.name,
                "sha256": sha256_file(material_path),
                "replay_material_sha256": entry.replay_material_sha256,
            }
        ],
        "final_parity": {
            "manifest": final_manifest.name,
            "sha256": sha256_file(final_manifest),
        },
    }
    ledger_path = write_json(tmp_path / "ledger.json", ledger)
    output = tmp_path / "reconstruction-receipt.json"
    command = [
        sys.executable,
        str(Path(rebuild.__file__).resolve()),
        "--genesis-dump",
        str(genesis_dump),
        "--genesis-manifest",
        str(genesis_manifest),
        "--ledger",
        str(ledger_path),
        "--ledger-sha256",
        sha256_file(ledger_path),
        "--database",
        database,
        "--container-prefix",
        "teleo-genesis-ledger-live-test",
        "--tmpfs-mb",
        "256",
        "--max-target-query-ms",
        "5000",
        "--max-target-source-ratio",
        "100",
        "--output",
        str(output),
    ]
    completed = subprocess.run(
        command,
        cwd=rebuild.REPO_ROOT,
        text=True,
        capture_output=True,
        check=False,
        timeout=180,
    )

    assert completed.returncode == 0, completed.stderr + completed.stdout
    receipt = json.loads(output.read_text(encoding="utf-8"))
    assert receipt["status"] == "pass"
    assert receipt["genesis_parity"]["status"] == "pass"
    assert receipt["ledger"]["entries"][0]["status"] == "pass"
    assert receipt["ledger"]["entries"][0]["guarded_apply_executed"] is True
    assert receipt["ledger"]["entries"][0]["canonical_rows_exact"] is True
    assert receipt["final_parity"]["status"] == "pass"
    assert receipt["cleanup"]["container_absent"] is True
    assert receipt["safety"]["network_access_available_to_container"] is False
    assert receipt["safety"]["private_replay_material_emitted"] is False
    assert PRIVATE_MARKER not in completed.stdout
    assert PRIVATE_MARKER not in output.read_text(encoding="utf-8")
    assert stat.S_IMODE(output.stat().st_mode) == 0o600

    inspect = subprocess.run(
        ["docker", "container", "inspect", receipt["container"]["name"]],
        text=True,
        capture_output=True,
        check=False,
    )
    assert inspect.returncode != 0
