from __future__ import annotations

import json
from pathlib import Path

ROOT = Path(__file__).resolve().parents[1]
REPORT_DIR = ROOT / "docs" / "reports" / "leo-working-state-20260709"
MANIFEST = REPORT_DIR / "skill-pack-manifest.json"


def _skill(name: str) -> str:
    return (ROOT / ".agents" / "skills" / name / "SKILL.md").read_text(
        encoding="utf-8"
    )


def test_manifest_indexes_valid_repo_native_skills() -> None:
    manifest = json.loads(MANIFEST.read_text(encoding="utf-8"))

    assert manifest["status"] == "repo_native_validated"
    assert manifest["repo_skill_root"] == ".agents/skills"
    assert manifest["validation"] == "tests/test_repo_skill_pack.py"
    assert "37/37" in manifest["claim_ceiling"]
    assert "auto-synchronized" in manifest["claim_ceiling"]
    assert "apply worker remained disabled/inactive" in manifest["claim_ceiling"]

    for entry in manifest["skills"]:
        path = ROOT / entry["path"]
        text = path.read_text(encoding="utf-8")
        assert path.is_file()
        assert text.startswith("---\n")
        assert f"name: {entry['name']}\n" in text.split("---\n", 2)[1]
        assert "description:" in text.split("---\n", 2)[1]

    for relative in manifest["reference_files"]:
        assert (ROOT / relative).is_file(), relative


def test_db_change_skill_tracks_guarded_v2_runtime_proof() -> None:
    text = _skill("teleo-kb-db-change-workflow")
    squashed = " ".join(text.split())

    for required in (
        "`approve_claim` v2",
        "kb_review",
        "kb_apply",
        "kb_gate_owner",
        "NOINHERIT",
        "37/37",
        "exact table deltas",
        "source hashes",
        "trusted operator-only canonical writer",
        "run_approve_claim_isolated_container_canary.sh",
    ):
        assert required in text

    assert "does not prove byte-for-byte live content" in squashed
    assert "production permission migration" in squashed
    assert "pr72-vps-auto-deploy-runtime-nonchange-current.md" in text


def test_gcp_skill_uses_current_cloud_sql_truth_and_exact_gate() -> None:
    text = _skill("teleo-gcp-parity-ops")
    squashed = " ".join(text.split())
    observability = json.loads(
        (REPORT_DIR / "gcp-leo-runtime-observability-current.json").read_text(
            encoding="utf-8"
        )
    )

    for required in (
        "teleo-pgvector-standby",
        "PostgreSQL `16.14`",
        "teleo-staging-net",
        "public IP disabled",
        "Cloud SQL Studio",
        "GCP Studio authenticated",
        "begin transaction read only",
        "DB contents",
        "gcp-leo-runtime-observability-current.json",
        "leoclean-cloudsql-memory-sync.service",
        "zero seven-day entries",
    ):
        assert required in text

    assert "no enabled existing" in squashed
    assert "IAM DB principal" in squashed
    assert "Do not submit a raw password" in text
    assert "AppleScript" in text
    assert observability["delivery_context"]["gcp_deployment_status"] == "unproven"
    assert observability["delivery_context"]["gcp_deployed_sha_proven"] is False


def test_vps_onboarding_and_cory_skills_point_to_current_proof() -> None:
    vps = _skill("teleo-vps-runtime-ops")
    provenance = _skill("teleo-infra-provenance")
    onboarding = _skill("teleo-leo-onboarding")
    cory = _skill("working-leo-cory-outcomes")

    assert "reasoning tools `17`" in vps
    assert "current source hashes" in vps
    assert "`teleo-auto-deploy.timer`" in vps
    assert "separate state changes" in vps
    assert "/opt/teleo-eval/.last-deploy-sha" in provenance
    assert "does not prove a gateway restart" in " ".join(provenance.split())
    assert "gcp-cloud-sql-t3-live-readonly-current.md" in onboarding
    assert "gcp-leo-runtime-observability-current.md" in onboarding
    assert "GCP Studio authenticated" not in onboarding
    assert "37/37" in cory
    assert "Approved is not the same as applied" in cory
    assert "Next Cory-style follow-up:" in cory