"""Read-only original-evidence and workspace isolation audit. No device commands."""
import argparse
import hashlib
import json
from pathlib import Path
import subprocess

A = Path(__file__).resolve().parent
p = argparse.ArgumentParser()
p.add_argument('--study', type=Path, required=True)
args = p.parse_args()
def sha(path): return hashlib.sha256(path.read_bytes()).hexdigest()
old = args.study.resolve()
source = old.parent / 'region-action-opportunity-study-20261107'
manifest = json.loads((source/'evidence/archive-manifest.json').read_text())
rows = []
for run in manifest:
    rid = run['app']+'-'+run['rep']
    trace = [json.loads(x) for x in (old/'analysis/traces'/f'{rid}.jsonl').read_text().splitlines()]
    base = Path(run['graph_path']).parent
    rawpath = base/'jev-events.jsonl'
    raw = rawpath.read_bytes().splitlines()
    for e in trace:
        assert json.loads(raw[e['event_line']-1]) == e['raw_event'], (rid, e['transition_id'])
        assert e['raw_event']['input_confirmed'] is True
    assert len(trace) == int(run['confirmed_transitions'])
    assert sha(Path(run['graph_path'])) == run['graph_sha256']
    rows.append(dict(run=rid,confirmed=len(trace),raw_event_lines_exact=True,
                     raw_event_sha256=sha(rawpath),graph_sha256=run['graph_sha256']))
assert sum(r['confirmed'] for r in rows)==23279
recorded=json.loads((A/'source-hashes.json').read_text())
assert all(sha(Path(k))==v for k,v in recorded.items())
protected=json.loads((A/'protected-before.json').read_text())
drift=[]
for k,v in protected.items():
    f=Path(k)
    if not f.exists() or sha(f)!=v:drift.append(k)
repo=A.parents[2]
allowed={'native/src/com/android/commands/monkey/ape/agent/StatefulAgent.java',
         'native/src/com/android/commands/monkey/ape/jev/JevRuntime.java',
         'native/src/com/android/commands/monkey/ape/jev/JevEvidenceAudit.java',
         'native/src/com/android/commands/monkey/ape/jev/JevFlowShadow.java'}
changed=set(subprocess.check_output(['git','diff','c161e65','--name-only','--','native/src'],cwd=repo,text=True).splitlines())
assert changed<=allowed, changed-allowed
out=dict(status='PASS' if not drift else 'EVIDENCE_PASS_EXTERNAL_DRIFT_RECORDED',runs=rows,
         source_manifest_files=len(recorded),protected_files=len(protected),external_drift=drift,
         tracked_native_change_whitelist=sorted(changed),
         device_or_provider_operations=0,source_data_modified=False,
         note='Hash agreement proves byte preservation; concurrent external drift is reported, never reverted.')
(A/'delivery-audit.json').write_text(json.dumps(out,ensure_ascii=False,indent=2)+'\n')
print(json.dumps(dict(status=out['status'],confirmed=23279,protected_files=len(protected),external_drift=len(drift))))