#!/usr/bin/env python3
"""Fail-closed static and clean-server evidence qualification for RC1."""
import argparse, hashlib, json, os, platform, subprocess
from pathlib import Path

ROOT = Path(__file__).resolve().parents[2]
RELEASE = Path(__file__).resolve().parent

def sha(path):
    h=hashlib.sha256()
    with path.open("rb") as f:
        for block in iter(lambda:f.read(1024*1024), b""): h.update(block)
    return h.hexdigest()

def main():
    p=argparse.ArgumentParser(); p.add_argument("--iso"); p.add_argument("--clean-server", action="store_true"); p.add_argument("--output", required=True); a=p.parse_args()
    checks=[]
    def check(name, ok, evidence=""): checks.append({"name":name,"status":"pass" if ok else "fail","evidence":evidence})
    manifest=json.loads((RELEASE/"release.json").read_text()); profiles=json.loads((RELEASE/"feature-profiles.json").read_text())
    check("release-version", manifest.get("version")=="1.0.0-rc1")
    check("model-less", manifest.get("modelPolicy")=="model-less" and not any("model" in x.lower() for x in manifest.get("includedProfiles",[])))
    check("agent-runtimes-disabled", profiles.get("rc1AgentRuntimePolicy")=="deny-all" and all(v["limits"]["activeEdgeAgents"]==0 for v in profiles["profiles"].values()))
    check("browser-commissioning", (ROOT/"autoinstall/websetup/server.py").is_file())
    check("backup-restore", (ROOT/"scripts/cezen-backup.sh").is_file())
    iso=Path(a.iso).resolve() if a.iso else None
    check("iso-present", bool(iso and iso.is_file() and iso.stat().st_size>100_000_000), str(iso or "not supplied"))
    if iso and iso.is_file(): check("iso-checksum", True, sha(iso))
    check("clean-server", a.clean_server and platform.system()=="Linux" and os.geteuid()==0, "must run as root on wiped disposable Linux target")
    check("disconnected", os.environ.get("NEXUS_OFFLINE_QUALIFICATION")=="1", "set only inside network-denied qualification lab")
    result={"schema":"nexus.qualification.v1","release":"1.0.0-rc1","checks":checks,"qualified":all(x["status"]=="pass" for x in checks)}
    Path(a.output).write_text(json.dumps(result,indent=2)+"\n")
    raise SystemExit(0 if result["qualified"] else 1)

if __name__=="__main__": main()