#!/usr/bin/env bash
set -uo pipefail

# CASAN Plan-17 Track 1 — Loop Budget Governor (loop-breaker).
#
# Proves:
#   * usage within the matched ceiling -> CONTINUE (exit 0),
#   * exceeding a ceiling -> HALT(budget) (exit 3),
#   * on_exceed=escalate -> ESCALATE (exit 4),
#   * NO policy file -> strictest built-in ceiling still bounds the run,
#   * present-but-corrupt policy -> fail-closed HALT (exit 3, never "run on"),
#   * unknown profile -> deny-by-default strict ceiling,
#   * a HALT writes a hash-linked audit record,
#   * state is redirected -> the repo's .specify/state stays clean.
#
# Deterministic; hermetic; no model / network / docker.

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
source "$SCRIPT_DIR/../scripts/bash/casan-paths.sh"
PROJECT_ROOT="$CASAN_APP_ROOT"
GOV="$CASAN_HARNESS_ROOT/scripts/bash/loop-governor.py"
POLICY="$CASAN_HARNESS_ROOT/config/loop-policy.yaml"

WORK="$(mktemp -d)"
trap 'rm -rf "$WORK"' EXIT

# Redirect all loop state into the sandbox so the repo is never polluted.
export CASAN_LOOP_STATE_ROOT="$WORK/state"

PASS=0; FAIL=0
pass() { echo "PASS: $1"; PASS=$((PASS + 1)); }
fail() { echo "FAIL: $1"; FAIL=$((FAIL + 1)); }

# run <expected_rc> <desc> -- <governor args...>; captures stdout in $OUT
run_gov() {
  local expect="$1"; shift
  local desc="$1"; shift
  [[ "$1" == "--" ]] && shift
  set +e
  OUT="$(python3 "$GOV" "$@" 2>/dev/null)"
  local rc=$?
  set -e 2>/dev/null || true
  if [[ "$rc" -eq "$expect" ]]; then pass "$desc (rc=$rc)"; else fail "$desc (rc=$rc, want $expect)"; fi
}

echo "===== Plan-17 T1: Loop Budget Governor ====="

export CASAN_LOOP_POLICY_FILE="$POLICY"

# 1) within prod/L2 ceiling (max_steps 20) -> CONTINUE
run_gov 0 "within ceiling -> CONTINUE" -- check --run-id r1 --step 5 \
  --tokens 1000 --elapsed 10 --cost 0.1 --profile prod --delegation-level L2
grep -q '"decision": "CONTINUE"' <<<"$OUT" \
  && pass "CONTINUE decision in envelope" || fail "missing CONTINUE decision"

# 2) exceed step ceiling -> HALT(budget)
run_gov 3 "exceed max_steps -> HALT" -- check --run-id r2 --step 21 \
  --profile prod --delegation-level L2
grep -q '"reason": "budget_exceeded"' <<<"$OUT" \
  && pass "HALT reason budget_exceeded" || fail "missing budget_exceeded reason"

# 3) exceed cost ceiling on the tightest level (L0 max_cost 0.10) -> HALT
run_gov 3 "exceed max_cost_usd (L0) -> HALT" -- check --run-id r3 --step 1 \
  --cost 0.5 --profile prod --delegation-level L0

# 4) on_exceed=escalate -> ESCALATE (exit 4)
cat > "$WORK/escalate.yaml" <<'YAML'
version: 1
profiles:
  prod:
    defaults:
      max_steps: 2
      on_exceed: escalate
YAML
CASAN_LOOP_POLICY_FILE="$WORK/escalate.yaml" \
  run_gov 4 "on_exceed=escalate -> ESCALATE" -- check --run-id r4 --step 9 --profile prod
grep -q '"decision": "ESCALATE"' <<<"$OUT" \
  && pass "ESCALATE decision in envelope" || fail "missing ESCALATE decision"

# 5) present-but-corrupt policy -> fail-closed HALT
printf 'foo: *undefined_anchor\n' > "$WORK/corrupt.yaml"
CASAN_LOOP_POLICY_FILE="$WORK/corrupt.yaml" \
  run_gov 3 "corrupt policy -> fail-closed HALT" -- check --run-id r5 --step 1 --profile prod
grep -q '"reason": "fail_closed"' <<<"$OUT" \
  && pass "corrupt policy reports fail_closed" || fail "corrupt policy did not fail_closed"

# 6) NO policy file -> strict ceiling (max_steps 3). step 4 halts, step 2 continues.
CASAN_LOOP_POLICY_FILE="$WORK/does-not-exist.yaml" \
  run_gov 3 "no policy, step 4 > strict(3) -> HALT" -- check --run-id r6 --step 4 --profile prod
CASAN_LOOP_POLICY_FILE="$WORK/does-not-exist.yaml" \
  run_gov 0 "no policy, step 2 <= strict(3) -> CONTINUE" -- check --run-id r6b --step 2 --profile prod

# 7) unknown profile -> deny-by-default strict ceiling (step 4 > 3 -> HALT)
run_gov 3 "unknown profile -> strict ceiling" -- check --run-id r7 --step 4 --profile staging

# 8) a HALT wrote a hash-linked audit record; first record chains to genesis.
AUDIT="$CASAN_LOOP_STATE_ROOT/audit/loop-audit.jsonl"
if [[ -s "$AUDIT" ]]; then
  pass "audit log written on HALT"
  python3 - "$AUDIT" <<'PY' && pass "audit chain links to genesis" || fail "audit chain broken"
import json, sys
lines=[l for l in open(sys.argv[1]) if l.strip()]
prev="0"*64
ok=True
for l in lines:
    e=json.loads(l)
    if e.get("prev_hash")!=prev: ok=False; break
    prev=e.get("hash")
raise SystemExit(0 if ok and lines else 1)
PY
else
  fail "audit log not written on HALT"
fi

# 9) no repo pollution: the default in-repo state dir must not have been created.
if [[ -d "$CASAN_STATE_ROOT/state" ]] && [[ -n "$(ls -A "$CASAN_STATE_ROOT/state" 2>/dev/null)" ]]; then
  fail "repo .specify/state was polluted"
else
  pass "repo .specify/state stays clean"
fi

echo ""
echo "===== T1 SUMMARY: PASS=$PASS FAIL=$FAIL ====="
[[ "$FAIL" -eq 0 ]] || exit 1