#!/usr/bin/env python3
"""Replay public Supabase pilot artifacts with Python 3.11+ and Docker.

This runs only the published fixture/checker code and SQL in disposable,
network-isolated PostgreSQL containers. It does not call a model or access
Supabase credentials or an existing database. Inspect the kit before execution.
"""
import argparse, hashlib, importlib, json, subprocess, sys, tempfile
from pathlib import Path

parser=argparse.ArgumentParser(description=__doc__)
parser.add_argument('--kit',required=True,type=Path)
parser.add_argument('--evidence',type=Path)
parser.add_argument('--checker',choices=('primary','corrected'),default='primary')
selection=parser.add_mutually_exclusive_group(required=True)
selection.add_argument('--controls',action='store_true')
selection.add_argument('--case',help='phase/trajectory ID from the evidence JSON')
selection.add_argument('--all',action='store_true')
args=parser.parse_args()
kit=json.loads(args.kit.read_text())
assert kit['format']=='rulemetric-supabase-replay-kit-v1'
allowed={'__init__.py','fixtures.py','database.py','grader.py','grader_corrected.py'}
assert set(kit['sources'])==allowed
with tempfile.TemporaryDirectory(prefix='rulemetric-public-replay-') as work:
 package=Path(work)/'supabase_rls';package.mkdir()
 for name,entry in kit['sources'].items():
  assert hashlib.sha256(entry['content'].encode()).hexdigest()==entry['sha256']
  (package/name).write_text(entry['content'])
 sys.path.insert(0,work)
 grader=importlib.import_module('supabase_rls.grader' if args.checker=='primary' else 'supabase_rls.grader_corrected')
 fixtures=importlib.import_module('supabase_rls.fixtures')
 image=kit['imageReference']
 # Fetch the exact published digest; existing unrelated containers are untouched.
 if subprocess.run(['docker','image','inspect',image],stdout=subprocess.DEVNULL,stderr=subprocess.DEVNULL).returncode:
  subprocess.run(['docker','pull',image],check=True)
 results=[]
 if args.controls:
  for task in fixtures.TASKS:
   for stage in (1,2):
    grade=grader.grade(image,task,[fixtures.reference_sql(task,s) for s in range(1,stage+1)])
    row={'task':task,'stage':stage,'checker':args.checker,'passed':grade['passed']}
    results.append(row);print(json.dumps(row),flush=True)
 else:
  if args.evidence is None:parser.error('--evidence is required when replaying submitted SQL')
  evidence=json.loads(args.evidence.read_text())
  rows=[r for r in evidence['trajectoryRecords'] if args.all or r['phase']+'/'+r['id']==args.case]
  if not rows:parser.error('Case not found')
  for row in rows:
   migrations=[]
   for artifact in row['migrations']:
    assert hashlib.sha256(artifact['sql'].encode()).hexdigest()==artifact['sha256']
    migrations.append(artifact['sql'])
   expected=row['frozenGrades'] if args.checker=='primary' else row['sensitivityGrades']
   for stage in range(1,len(migrations)+1):
    grade=grader.grade(image,row['task'],migrations[:stage])
    # Exact grade equality includes denied operations, diagnostics and preservation.
    outcome={'case':row['phase']+'/'+row['id'],'stage':stage,'checker':args.checker,'passed':grade['passed'],'matchesPublishedGrade':grade==expected[stage-1]}
    results.append(outcome);print(json.dumps(outcome),flush=True)
 print(json.dumps({'replays':len(results),'allMatched':all(r.get('matchesPublishedGrade',r['passed']) for r in results)}))
 if not all(r.get('matchesPublishedGrade',r['passed']) for r in results):sys.exit(1)