#!/bin/sh
set -eu

ROOT=$(CDPATH= cd -- "$(dirname -- "$0")/.." && pwd)
cd "$ROOT"

export PYTHONDONTWRITEBYTECODE=1
RELEASE_TAG=v3-source-2026-08-27

need() {
  command -v "$1" >/dev/null 2>&1 || {
    printf 'ERROR: required command not found: %s\n' "$1" >&2
    exit 1
  }
}

run() {
  printf '\n==> %s\n' "$1"
  shift
  "$@"
}

need git
need python3
need node
need npm

if git submodule status --recursive | grep -Eq '^[-+U]'; then
  printf 'ERROR: pinned dependencies are missing or do not match this commit.\n' >&2
  printf 'Run: git submodule update --init --recursive\n' >&2
  exit 1
fi

if [ -n "$(git status --porcelain --untracked-files=normal)" ]; then
  printf 'ERROR: verification requires a clean checkout.\n' >&2
  git status --short >&2
  exit 1
fi

HEAD_BEFORE=$(git rev-parse HEAD)
TREE_BEFORE=$(git rev-parse HEAD^{tree})
STATUS_BEFORE=$(git status --porcelain --untracked-files=normal)

TAG_COMMIT=$(git rev-parse -q --verify "refs/tags/$RELEASE_TAG^{commit}") || {
  printf 'ERROR: required release tag is missing: %s\n' "$RELEASE_TAG" >&2
  printf 'Run: git fetch origin tag %s\n' "$RELEASE_TAG" >&2
  exit 1
}

if [ "$HEAD_BEFORE" != "$TAG_COMMIT" ]; then
  printf 'ERROR: checkout is not the reviewed release tag %s.\n' "$RELEASE_TAG" >&2
  printf 'Expected commit: %s\n' "$TAG_COMMIT" >&2
  printf 'Current commit:  %s\n' "$HEAD_BEFORE" >&2
  printf 'Run: git switch --detach %s\n' "$RELEASE_TAG" >&2
  exit 1
fi

printf 'Vaultfire V3 source verification\n'
printf 'release tag: %s\n' "$RELEASE_TAG"
printf 'commit: %s\n' "$HEAD_BEFORE"
printf 'tree:   %s\n' "$TREE_BEFORE"
printf 'mode:   read-only source and policy checks; no RPC, wallet, signing, deployment, or activation\n'

run "Repository source-candidate hygiene" \
  python3 -B ci/check_source_candidate_hygiene.py
run "Frozen V2 ABI package" \
  python3 -B baseline/check_v2_abi_package.py --strict
run "Frozen V2 runtime identities" \
  python3 -B ci/check_v2_bytecode_manifest.py
run "Canonical Base V3 source snapshot" \
  python3 -B ci/check_base_v3_source_snapshot.py
run "V3 Open exact-source checker" \
  python3 -B v3-open-spec/tools/check.py
run "V3 Open tests" \
  python3 -B -m unittest discover -s v3-open-spec/tests -p 'test_*.py'
run "Migration-ledger tests" \
  python3 -B -m unittest discover -s v3-migration/completeness/tests -p 'test_*.py'
run "Operations-gate tests" \
  python3 -B -m unittest discover -s v3-operations/tests -p 'test_*.py'
run "Partner-package tests" \
  python3 -B -m unittest discover -s pr10/partner-package/tests -p 'test_*.py'
run "Solana supported-source policy tests" \
  npm --prefix repos/vaultfire-solana test

HEAD_AFTER=$(git rev-parse HEAD)
TREE_AFTER=$(git rev-parse HEAD^{tree})
STATUS_AFTER=$(git status --porcelain --untracked-files=normal)
TAG_COMMIT_AFTER=$(git rev-parse -q --verify "refs/tags/$RELEASE_TAG^{commit}")

if [ "$HEAD_BEFORE" != "$HEAD_AFTER" ] ||
   [ "$TREE_BEFORE" != "$TREE_AFTER" ] ||
   [ "$STATUS_BEFORE" != "$STATUS_AFTER" ] ||
   [ "$TAG_COMMIT" != "$TAG_COMMIT_AFTER" ] ||
   [ "$HEAD_AFTER" != "$TAG_COMMIT_AFTER" ]; then
  printf 'ERROR: verification changed the checkout.\n' >&2
  git status --short >&2
  exit 1
fi

printf '\nPASS: exact source candidate verified without changing the checkout.\n'
printf 'release tag: %s\n' "$RELEASE_TAG"
printf 'commit: %s\n' "$HEAD_AFTER"
printf 'tree:   %s\n' "$TREE_AFTER"
printf 'This is source-review evidence, not deployment authorization or partner readiness.\n'
