#!/usr/bin/env bash
set -uo pipefail

# Plan-18 MVP-2 Track 8.4: chat turns that exceed delegated authority are
# escalated into the Plan-13 approval inbox and remain tamper-verifiable.

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
source "$SCRIPT_DIR/../scripts/bash/casan-paths.sh"
TURN="$CASAN_HARNESS_ROOT/scripts/bash/chat-turn.py"
APPROVAL="$CASAN_HARNESS_ROOT/scripts/bash/approval-inbox.py"
REPLAY="$CASAN_HARNESS_ROOT/scripts/bash/chat-replay.py"
WORK="$(mktemp -d)"
trap 'rm -rf "$WORK"' EXIT
export CASAN_STATE_ROOT="$WORK/state"
export CASAN_APPROVAL_INBOX_FILE="$WORK/approval-inbox.json"

PASS=0; FAIL=0
pass() { echo "PASS: $1"; PASS=$((PASS + 1)); }
fail() { echo "FAIL: $1"; FAIL=$((FAIL + 1)); }

echo "===== Plan-18 MVP-2 chat approvals escalation ====="

set +e
python3 "$TURN" ask \
  --message "Summarize Plan 18 MVP-2 status" \
  --actor alice \
  --role viewer \
  --chat-id approval-chat \
  --tenant tenant-a \
  --delegation-level 1 > "$WORK/escalated.json"
RC=$?
set -e 2>/dev/null || true

python3 - "$WORK/escalated.json" "$RC" <<'PY' \
  && pass "delegation escalation creates pending approval proposal" || fail "chat turn did not escalate to approval inbox"
import json, sys
d = json.load(open(sys.argv[1]))
assert int(sys.argv[2]) == 3
assert d["success"] is False
assert d["decision"] == "ESCALATED"
assert d["agent_binding"]["decision"] == "REQUIRES_APPROVAL"
assert d["approval"]["proposal"]["status"] == "pending"
assert d["approval"]["proposal"]["action"] == "chat.escalate"
assert d["approval"]["proposal"]["payload"]["chat_id"] == "approval-chat"
PY

python3 "$APPROVAL" list --status pending > "$WORK/pending.json"
python3 - "$WORK/pending.json" <<'PY' \
  && pass "approval inbox lists escalated chat proposal" || fail "pending chat proposal missing from inbox"
import json, sys
d = json.load(open(sys.argv[1]))
assert d["count"] == 1
p = d["proposals"][0]
assert p["status"] == "pending"
assert p["action"] == "chat.escalate"
assert p["payload"]["agent_binding"]["requires_approval"] is True
PY

python3 "$REPLAY" verify-chain > "$WORK/chat-chain.out" \
  && grep -q '"decision": "OK"' "$WORK/chat-chain.out" \
  && pass "escalated chat turn audit chain verifies" || fail "escalated chat audit chain invalid"

python3 "$APPROVAL" verify-audit > "$WORK/approval-audit.out" \
  && grep -q "APPROVAL_INBOX_AUDIT ok=true" "$WORK/approval-audit.out" \
  && pass "approval oversight audit chain verifies" || fail "approval oversight audit invalid"

echo ""
echo "===== CHAT APPROVAL SUMMARY: PASS=$PASS FAIL=$FAIL ====="
[[ "$FAIL" -eq 0 ]] || exit 1