#!/usr/bin/env python3
"""Describe/verify unsigned governance calldata without signing or broadcasting."""
from __future__ import annotations
import argparse, json
from pathlib import Path
from Crypto.Hash import keccak

ROOT = Path(__file__).resolve().parents[1]

def selector(signature: str) -> str:
    digest = keccak.new(digest_bits=256); digest.update(signature.encode())
    return '0x' + digest.hexdigest()[:8]

def main() -> int:
    parser = argparse.ArgumentParser(description=__doc__)
    parser.add_argument('proposal', type=Path, help='proposal template path')
    args = parser.parse_args()
    proposal = json.loads(args.proposal.read_text())
    action = proposal.get('action', {})
    # A package template must stay non-executable until engineering and review evidence populate a separate controlled record.
    if proposal.get('status') != 'template-not-submittable' or any(action.get(k) is not None for k in ('target','calldata')):
        raise SystemExit('REFUSED: only untouched, non-submittable blank templates may be processed by this helper.')
    if proposal.get('governance', {}).get('threshold') != 3 or proposal.get('governance', {}).get('timelockSeconds') != 86400:
        raise SystemExit('REFUSED: proposal does not declare 3-of-5 and 24-hour timing.')
    print(json.dumps({'proposalTemplate': proposal['templateId'], 'status': proposal['status'],
      'supportedDraftInterface': 'createProposal(address,uint256,bytes)',
      'createProposalSelector': selector('createProposal(address,uint256,bytes)'),
      'target': None, 'calldata': None,
      'result': 'No calldata generated: target and action calldata are intentionally blank; signing/broadcasting are unsupported.'}, indent=2))
    return 0
if __name__ == '__main__': raise SystemExit(main())
