#!/usr/bin/python3
"""One new immutable attempt lane; bounded own service/private fixture realm."""
import hashlib
import json
import os
from pathlib import Path
import subprocess
import sys
import time

repo = Path(__file__).resolve().parents[2]
base = Path('/home/archipelago/Reports/opencode-full-release-20261029')
assert len(sys.argv) == 3 and sys.argv[1].isalnum() and sys.argv[2] in ('sshparse', 'recovery', 'preflight', 'drift', 'stall', 'expiry')
lane = base / ('c01-access-owner-' + sys.argv[1])
lane.mkdir(mode=0o700, exist_ok=False)
paths = list((repo / 'scripts').glob('c01_access*.py'))
paths += list((repo / 'scripts/tests').glob('*access_owner*.py'))
paths += list((repo / 'scripts/tests').glob('test_c01_access*.py'))
paths += list((repo / 'image-recipe/configs').glob('*c01*access*'))
frozen = [repo / 'scripts' / name for name in ('c01_supervisor.py', 'c01_children.py', 'c01_views.py',
    'c01_nts.py', 'c01_recovery.py', 'c01_host_watch.py', 'runtime_owner.py',
    'c01_runtime.py', 'c01_runtime_groups.py', 'c01_runtime_view.py')]
def hashes(items):
    return {str(p.relative_to(repo)): hashlib.sha256(p.read_bytes()).hexdigest() for p in items}
before, frozen_before = hashes(paths), hashes(frozen)
(lane / 'source.json').write_text(json.dumps(before, indent=2))
(lane / 'frozen.json').write_text(json.dumps(frozen_before, indent=2))
unit = 'c01-access-fixture-' + sys.argv[1] + '-' + str(os.getpid())
command = ['sudo', '-n', 'systemd-run', '--quiet', '--wait', '--pipe', '--collect', '--unit=' + unit,
           '-p', 'Delegate=yes', '-p', 'DelegateSubgroup=supervisor', '-p', 'PrivateMounts=yes',
           '-p', 'PrivateNetwork=yes', '-p', 'ProtectSystem=strict', '-p', 'NoNewPrivileges=no',
           '-p', 'TemporaryFileSystem=/etc /run /home /root /var/lib /var/spool /tmp /var/tmp /opt',
           '-p', f'BindReadOnlyPaths={repo}:/opt/source',
           '-p', 'CPUAffinity=2 3', '-p', 'AllowedCPUs=2-3', '-p', 'CPUQuota=200%',
           '-p', 'MemoryMax=2G', '-p', 'MemorySwapMax=0', '-p', 'TasksMax=128',
           '-p', 'RuntimeMaxSec=120', '-p', 'TimeoutStopSec=10',
           '--setenv=C01_ACCESS_FIXTURE=1', '--setenv=C01_ACCESS_CASE=' + sys.argv[2],
           '--setenv=PYTHONDONTWRITEBYTECODE=1', '/usr/bin/unshare', '--pid', '--fork', '--mount-proc',
           '/usr/bin/python3', '-B', '/opt/source/scripts/tests/access_owner_fixture.py']
(lane / 'command.json').write_text(json.dumps(command, indent=2))
start = time.monotonic()
with (lane / 'stdout.log').open('wb') as out, (lane / 'stderr.log').open('wb') as err:
    try:
        code = subprocess.run(command, stdout=out, stderr=err, timeout=145).returncode
    except subprocess.TimeoutExpired:
        code = 124
        subprocess.run(['sudo', '-n', 'systemctl', 'stop', unit], timeout=20, check=False)
receipt = {'exit_code': code, 'seconds': time.monotonic() - start,
           'source_unchanged': hashes(paths) == before, 'frozen_unchanged': hashes(frozen) == frozen_before,
           'compiler_run': False, 'installed_acceptance': False}
(lane / 'result.json').write_text(json.dumps(receipt, indent=2))
print(lane, json.dumps(receipt), flush=True)
raise SystemExit(code)