"""Deterministic audit of invented AI-governance release evidence.

This module makes no network, deployment, legal-compliance, or production-safety
claim.  It demonstrates how a governance control plane can bind a bounded
release decision to immutable policy and evidence identities.
"""

from dataclasses import asdict, dataclass, fields
import hashlib
import json


CONTROL_IDS = (
    "impact-map",
    "evaluation-gate",
    "data-governance",
    "security-review",
    "human-oversight",
    "post-release-monitoring",
)
CONTROL_STATUSES = ("PASS", "FAIL", "WAIVED")
RISK_TIERS = ("MINIMAL", "LIMITED", "HIGH", "PROHIBITED")


def identity(value, *, maximum=160):
    if type(value) is not str or not value or value != value.strip():
        raise ValueError("exact non-empty identity required")
    if len(value) > maximum or any(ord(character) < 32 for character in value):
        raise ValueError("bounded printable identity required")
    return value


def sha256_text(value):
    identity(value, maximum=64)
    if len(value) != 64 or any(character not in "0123456789abcdef" for character in value):
        raise ValueError("lowercase sha256 digest required")
    return value


def integer(value, lower, upper):
    if type(value) is not int or not lower <= value <= upper:
        raise ValueError("bounded non-boolean integer required")
    return value


def exact_bool(value):
    if type(value) is not bool:
        raise ValueError("exact boolean required")
    return value


def bounded_sequence(value, lower, upper):
    if type(value) not in (tuple, list):
        raise ValueError("bounded tuple or list required")
    integer(len(value), lower, upper)
    return tuple(value)


def identity_tuple(value, lower, upper):
    result = bounded_sequence(value, lower, upper)
    for item in result:
        identity(item)
    if len(result) != len(set(result)):
        raise ValueError("duplicate identity")
    return result


def digest(value):
    try:
        encoded = json.dumps(
            value, sort_keys=True, separators=(",", ":"), allow_nan=False
        ).encode()
    except (TypeError, ValueError, OverflowError) as error:
        raise ValueError("canonical JSON value required") from error
    return hashlib.sha256(encoded).hexdigest()


def token(label):
    identity(label)
    return hashlib.sha256(label.encode()).hexdigest()


def seal(record):
    if type(record.content_id) is not str:
        raise ValueError("content digest requires exact string")
    data = asdict(record)
    data.pop("content_id")
    return digest(data)


def validate_record(record, cls):
    if type(record) is not cls:
        raise ValueError("concrete frozen record required")
    try:
        rebuilt = cls(
            **{field.name: getattr(record, field.name) for field in fields(cls)}
        )
    except (AttributeError, TypeError, ValueError, OverflowError) as error:
        raise ValueError("malformed record") from error
    if record != rebuilt or record.content_id != rebuilt.content_id:
        raise ValueError("noncanonical or modified record")
    return rebuilt


def scope_tuple(value):
    return identity_tuple(value, 6, 6)


@dataclass(frozen=True)
class GovernanceContract:
    scope: tuple = (
        "governance-policy-v1",
        "risk-taxonomy-v1",
        "evaluation-policy-v1",
        "exception-policy-v1",
        "monitoring-policy-v1",
        "fixture-v1",
    )
    required_controls: tuple = CONTROL_IDS
    maximum_evidence_age_days: int = 30
    maximum_waiver_expiry_days: int = 30
    minimum_observation_windows: int = 3
    maximum_open_exceptions: int = 0
    require_rollback: bool = True
    content_id: str = ""

    def __post_init__(self):
        object.__setattr__(self, "scope", scope_tuple(self.scope))
        object.__setattr__(
            self,
            "required_controls",
            identity_tuple(self.required_controls, 3, 20),
        )
        integer(self.maximum_evidence_age_days, 0, 3650)
        integer(self.maximum_waiver_expiry_days, 1, 3650)
        integer(self.minimum_observation_windows, 1, 100_000)
        integer(self.maximum_open_exceptions, 0, 100_000)
        if exact_bool(self.require_rollback) is not True:
            raise ValueError("bounded release requires a rollback path")
        expected = seal(self)
        if self.content_id and self.content_id != expected:
            raise ValueError("governance contract digest mismatch")
        object.__setattr__(self, "content_id", expected)


@dataclass(frozen=True)
class ControlEvidence:
    scope: tuple
    system_id: str
    release_id: str
    control_id: str
    owner: str
    evidence_digest: str
    status: str
    evidence_age_days: int
    enforcement_ready: bool
    waiver_approved: bool = False
    waiver_expiry_days: int = 0
    content_id: str = ""

    def __post_init__(self):
        object.__setattr__(self, "scope", scope_tuple(self.scope))
        identity(self.system_id)
        identity(self.release_id)
        identity(self.control_id)
        identity(self.owner)
        sha256_text(self.evidence_digest)
        identity(self.status)
        if self.status not in CONTROL_STATUSES:
            raise ValueError("unknown control status")
        integer(self.evidence_age_days, 0, 3650)
        exact_bool(self.enforcement_ready)
        exact_bool(self.waiver_approved)
        integer(self.waiver_expiry_days, 0, 3650)
        if self.status == "WAIVED":
            if not self.waiver_approved or self.waiver_expiry_days == 0:
                raise ValueError("waiver requires approval and a nonzero expiry")
        elif self.waiver_approved or self.waiver_expiry_days:
            raise ValueError("non-waived control cannot carry waiver state")
        expected = seal(self)
        if self.content_id and self.content_id != expected:
            raise ValueError("control evidence digest mismatch")
        object.__setattr__(self, "content_id", expected)


@dataclass(frozen=True)
class GovernanceEvidence:
    scope: tuple
    contract_content_id: str
    system_id: str
    release_id: str
    risk_tier: str
    impact_assessment_complete: bool
    human_accountability_confirmed: bool
    rollback_ready: bool
    monitoring_ready: bool
    observation_windows: int
    open_exceptions: int
    controls: tuple
    content_id: str = ""

    def __post_init__(self):
        object.__setattr__(self, "scope", scope_tuple(self.scope))
        sha256_text(self.contract_content_id)
        identity(self.system_id)
        identity(self.release_id)
        identity(self.risk_tier)
        if self.risk_tier not in RISK_TIERS:
            raise ValueError("unknown risk tier")
        exact_bool(self.impact_assessment_complete)
        exact_bool(self.human_accountability_confirmed)
        exact_bool(self.rollback_ready)
        exact_bool(self.monitoring_ready)
        integer(self.observation_windows, 0, 100_000)
        integer(self.open_exceptions, 0, 100_000)
        controls = bounded_sequence(self.controls, 1, 20)
        rebuilt_controls = tuple(validate_record(item, ControlEvidence) for item in controls)
        if any(item.scope != self.scope for item in rebuilt_controls):
            raise ValueError("control evidence outside governance scope")
        if any(
            item.system_id != self.system_id or item.release_id != self.release_id
            for item in rebuilt_controls
        ):
            raise ValueError("control evidence belongs to another system or release")
        control_ids = tuple(item.control_id for item in rebuilt_controls)
        if len(control_ids) != len(set(control_ids)):
            raise ValueError("duplicate control evidence")
        object.__setattr__(self, "controls", rebuilt_controls)
        expected = seal(self)
        if self.content_id and self.content_id != expected:
            raise ValueError("governance evidence digest mismatch")
        object.__setattr__(self, "content_id", expected)


@dataclass(frozen=True)
class GovernanceReport:
    decision: str
    violations: tuple
    system_id: str
    release_id: str
    risk_tier: str
    controls_present: int
    controls_required: int
    evidence_id: str
    claim: str = "LOCAL_GOVERNANCE_AUDIT_NOT_LEGAL_OR_PRODUCTION_APPROVAL"


def audit_governance(
    contract: GovernanceContract, evidence: GovernanceEvidence
) -> GovernanceReport:
    """Evaluate one immutable snapshot without changing any release system."""
    contract = validate_record(contract, GovernanceContract)
    evidence = validate_record(evidence, GovernanceEvidence)
    if evidence.scope != contract.scope or evidence.contract_content_id != contract.content_id:
        raise ValueError("evidence belongs to another governance contract")

    required = set(contract.required_controls)
    observed = {item.control_id: item for item in evidence.controls}
    unknown = sorted(set(observed) - required)
    if unknown:
        raise ValueError("evidence contains controls outside the contract")

    hard = []
    holds = []
    waived_controls = 0
    if evidence.risk_tier == "PROHIBITED":
        hard.append("prohibited-risk-tier")
    if not evidence.impact_assessment_complete:
        hard.append("impact-assessment-incomplete")
    if not evidence.human_accountability_confirmed:
        hard.append("human-accountability-unconfirmed")

    for control_id in contract.required_controls:
        control = observed.get(control_id)
        if control is None:
            holds.append(f"missing-control:{control_id}")
            continue
        if control.status == "FAIL":
            hard.append(f"failed-control:{control_id}")
        if control.status == "WAIVED":
            waived_controls += 1
            if control.waiver_expiry_days > contract.maximum_waiver_expiry_days:
                holds.append(f"waiver-expiry:{control_id}")
        if control.evidence_age_days > contract.maximum_evidence_age_days:
            holds.append(f"stale-control:{control_id}")
        if not control.enforcement_ready:
            holds.append(f"unenforced-control:{control_id}")

    if evidence.open_exceptions != waived_controls:
        holds.append("exception-count-mismatch")
    if evidence.open_exceptions > contract.maximum_open_exceptions:
        holds.append("open-exceptions")
    if evidence.observation_windows < contract.minimum_observation_windows:
        holds.append("observation-windows")
    if not evidence.monitoring_ready:
        holds.append("monitoring-unready")
    if contract.require_rollback and not evidence.rollback_ready:
        holds.append("rollback-unready")

    violations = tuple(hard + holds)
    if hard:
        decision = "BLOCK_RELEASE"
    elif holds:
        decision = "HOLD_RELEASE"
    else:
        decision = "AUTHORIZE_BOUNDED_RELEASE"
    return GovernanceReport(
        decision=decision,
        violations=violations,
        system_id=evidence.system_id,
        release_id=evidence.release_id,
        risk_tier=evidence.risk_tier,
        controls_present=len(observed),
        controls_required=len(contract.required_controls),
        evidence_id=evidence.content_id,
    )


def illustrative_fixture():
    contract = GovernanceContract()
    controls = tuple(
        ControlEvidence(
            scope=contract.scope,
            system_id="support-assistant",
            release_id="release-2026-09-27",
            control_id=control_id,
            owner=f"owner-{index}",
            evidence_digest=token(f"{control_id}-evidence-v1"),
            status="PASS",
            evidence_age_days=5 + index,
            enforcement_ready=True,
        )
        for index, control_id in enumerate(contract.required_controls, start=1)
    )
    evidence = GovernanceEvidence(
        scope=contract.scope,
        contract_content_id=contract.content_id,
        system_id="support-assistant",
        release_id="release-2026-09-27",
        risk_tier="HIGH",
        impact_assessment_complete=True,
        human_accountability_confirmed=True,
        rollback_ready=True,
        monitoring_ready=True,
        observation_windows=4,
        open_exceptions=0,
        controls=controls,
    )
    return contract, evidence


def main():
    contract, evidence = illustrative_fixture()
    report = audit_governance(contract, evidence)
    print("example=illustrative_only")
    print(f"decision={report.decision}")
    print(f"system={report.system_id};release={report.release_id};risk={report.risk_tier}")
    print(f"controls={report.controls_present}/{report.controls_required}")
    print(f"claim={report.claim}")


if __name__ == "__main__":
    main()