#!/usr/bin/env python3
"""Bind local RNG translation inputs to complete, exported REA byte evidence."""
import argparse
import hashlib
import json
from pathlib import Path
from lift_rng import arm64_image, file_range, FUNCTION_VA, BODY_SIZE, SEED_VA, SEED_SIZE, CONSTANT_VA

parser = argparse.ArgumentParser(description=__doc__)
parser.add_argument("binary", type=Path)
parser.add_argument("bundle", type=Path)
parser.add_argument("--include-version", action="store_true")
parser.add_argument("--include-map-header", action="store_true")
parser.add_argument("--include-map-header-entry", action="store_true")
args = parser.parse_args()
data = args.binary.read_bytes()
image, _ = arm64_image(data)
slice_hash = hashlib.sha256(image).hexdigest()
bundle = json.loads(args.bundle.read_text())
checks = []
ranges = [(FUNCTION_VA, BODY_SIZE), (SEED_VA, SEED_SIZE), (CONSTANT_VA, 32)]
if args.include_version:
    ranges.append((0x10150bf28, 192))
if args.include_map_header:
    ranges.append((0x1014c6aac, 332))
if args.include_map_header_entry:
    ranges.append((0x10010582c, 4))
for address, length in ranges:
    matches = []
    offset = file_range(image, address, length)
    expected = image[offset:offset + length]
    for record in bundle["records"]:
        if record.get("operation") != "read_bytes":
            continue
        if record.get("authority") != "shipped-artifact" or record.get("confidence") != "observed":
            continue
        if record.get("subject", {}).get("digest", {}).get("sha256") != slice_hash:
            continue
        value = record["normalized_result"]
        if (value["address"] == hex(address) and value["complete"]
                and value["returned_bytes"] == length and value["requested_bytes"] == length):
            if bytes.fromhex(value["bytes_hex"]) != expected:
                raise ValueError("REA byte evidence contradicts the local input")
            matches.append(record["evidence_id"])
    if not matches:
        raise ValueError(f"No complete matching REA byte evidence for {hex(address)}")
    checks.append({"address": hex(address), "bytes": length, "evidence_ids": matches,
                   "sha256": hashlib.sha256(expected).hexdigest()})
report = {"status": "pass", "scope": "translation input bytes, not full behavioral equivalence",
          "artifact_sha256": hashlib.sha256(data).hexdigest(), "arm64_slice_sha256": slice_hash,
          "checks": checks}
destination = "build/map-header/rea-provenance.json" if args.include_map_header else \
    "build/version/rea-provenance.json" if args.include_version else "build/rng/rea-provenance.json"
Path(destination).write_text(json.dumps(report, indent=2) + "\n")
print(json.dumps(report, indent=2))