#!/usr/bin/env bash
# scripts/verify_phase07.sh - Phase 07 architecture-v1-finalization gate.
set -u
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
cd "$ROOT"
fail() { echo "FAIL: $*" >&2; exit 1; }
ok()   { echo "ok: $*"; }

# --- Check 1: all 9 deliverable files exist ---
for f in docs/architecture-v1.0.md \
         schemas/ir.schema.json \
         schemas/policy_check_result.schema.json \
         schemas/contract.schema.json \
         platform/confidence_signal.py \
         platform/audit_ledger_design.md \
         platform/hitl_matrix_design.md \
         platform/separation_of_duties.py \
         adapters/terraform/policy/checkov_adapter.py; do
  [ -f "$f" ] || fail "missing $f"
done
ok "all 9 deliverable files exist"

# --- Check 2: 3 JSON Schemas are valid Draft 2020-12 ---
# Run python from /tmp so the repo's `platform/` package does not shadow the
# stdlib `platform` module (jsonschema imports uuid -> platform.system();
# our platform/ shadows it when cwd is repo root and on sys.path[0]).
check_schema() {
  ( cd /tmp && python3 -c "
import json, jsonschema
s = json.load(open('$1'))
jsonschema.Draft202012Validator.check_schema(s)
" >/dev/null 2>&1 )
}
for s in "$ROOT/schemas/ir.schema.json" "$ROOT/schemas/policy_check_result.schema.json" "$ROOT/schemas/contract.schema.json"; do
  check_schema "$s" || fail "$(basename "$s") is not valid Draft 2020-12"
done
ok "3 JSON Schemas validate as Draft 2020-12"

# --- Check 3: 3 .py files py_compile ---
for p in platform/confidence_signal.py platform/separation_of_duties.py adapters/terraform/policy/checkov_adapter.py; do
  python3 -m py_compile "$p" || fail "$p py_compile failed"
done
ok "3 .py files py_compile"

# --- Check 4: 3 .md design files non-empty ---
for m in platform/audit_ledger_design.md platform/hitl_matrix_design.md docs/architecture-v1.0.md; do
  [ -s "$m" ] || fail "$m is empty"
done
ok "3 .md design files non-empty"

# --- Check 5: all 11 decision IDs + OpenTofu in PROJECT.md ---
for id in W1.A W1.B W2.A W3.D W3.E BA.A BA.B BA.C BA.D BA.E BA.F; do
  grep -q "$id" .ciagent/PROJECT.md || fail "missing $id in PROJECT.md"
done
grep -qi "opentofu" .ciagent/PROJECT.md || fail "missing OpenTofu in PROJECT.md"
ok "all 11 decision IDs + OpenTofu present in PROJECT.md"

# --- Check 6: docs/architecture-v1.0.md status is v1.0 ---
grep -q "v1.0" docs/architecture-v1.0.md || fail "architecture-v1.0.md missing v1.0"
ok "docs/architecture-v1.0.md status is v1.0"

# --- Check 7: D-040..D-044 present in PROJECT.md ---
for d in D-040 D-041 D-042 D-043 D-044; do
  grep -q "$d" .ciagent/PROJECT.md || fail "missing $d in PROJECT.md"
done
ok "D-040..D-044 present in PROJECT.md"

# --- Check 8: spike contract validates against contract schema ---
echo '{"stack":"l2-static-asset","environment":"dev","inputs":{"bucket_name":"x","region":"us-east-1"}}' > /tmp/spike-contract.json
( cd /tmp && python3 -c "
import json, jsonschema
jsonschema.validate(json.load(open('/tmp/spike-contract.json')), json.load(open('$ROOT/schemas/contract.schema.json')))
" ) || fail "spike contract does not validate against contract schema"
ok "spike contract validates against contract schema"

# --- Check 9: minimal IR validates against IR schema ---
echo '{"version":"1.0.0","stack":{"name":"l2-static-asset","kind":"l2","depth":1},"resources":[{"id":"s3","type":"aws:s3:bucket","module":"l1-s3@1.0.0","inputs":{"bucket_name":"x","region":"us-east-1"}}]}' > /tmp/spike-ir.json
( cd /tmp && python3 -c "
import json, jsonschema
jsonschema.validate(json.load(open('/tmp/spike-ir.json')), json.load(open('$ROOT/schemas/ir.schema.json')))
" ) || fail "minimal IR does not validate against IR schema"
ok "minimal IR validates against IR schema"

echo "VERIFIED — Phase 07: architecture v1.0 finalized; 6 files authored + 11 decisions resolved"