eidetic-engine 0.15.2

//! Read-only environment attestation collector.
//!
//! This module adapts existing swarm-brief source probes into the
//! `ee.environment_attestation.v1` payload shape. It intentionally owns no CLI
//! formatting and runs no Cargo/build/test command itself.

use std::collections::BTreeSet;

use chrono::{DateTime, Utc};
use serde::Serialize;
use serde_json::Value;

use crate::core::swarm_brief::{
    SwarmBriefCollectOptions, SwarmBriefCommandRunner, SwarmBriefDegradation, SwarmBriefReport,
    SwarmBriefSourceKind, SwarmBriefSourceSnapshot, SwarmBriefSourceStatus,
    agent_mail_snapshot_producer_command_template, collect_swarm_brief,
};

pub const ENVIRONMENT_ATTESTATION_SCHEMA_V1: &str = "ee.environment_attestation.v1";
pub const ENVIRONMENT_ATTESTATION_REDACTION_STATUS: &str =
    "counts_ids_statuses_path_patterns_command_templates_no_mail_body_no_file_content";

#[derive(Clone, Debug, Eq, PartialEq, Serialize)]
#[serde(rename_all = "camelCase")]
pub struct EnvironmentAttestationReport {
    pub schema: &'static str,
    pub attestation_id: String,
    pub workspace: String,
    pub generated_at: DateTime<Utc>,
    pub redaction_status: &'static str,
    pub summary: EnvironmentAttestationSummary,
    pub source_authority: Vec<EnvironmentAttestationSourceAuthorityEntry>,
    pub verdict: EnvironmentAttestationVerdict,
    pub evidence_refs: Vec<String>,
    pub recovery_actions: Vec<EnvironmentAttestationRecoveryAction>,
    pub degraded: Vec<EnvironmentAttestationDegradation>,
}

#[derive(Clone, Debug, Eq, PartialEq, Serialize)]
#[serde(rename_all = "camelCase")]
pub struct EnvironmentAttestationSummary {
    pub safe_to_claim: bool,
    pub remote_verification_admitted: Option<bool>,
    pub source_test_verdict: EnvironmentAttestationSourceTestVerdict,
    pub environment_verdict: EnvironmentAttestationVerdict,
    pub local_cargo_fallback_observed: bool,
}

#[derive(Clone, Copy, Debug, Default, Eq, PartialEq)]
pub struct EnvironmentAttestationSummaryInputs {
    pub local_cargo_fallback_observed: bool,
    pub remote_environment_blocked: bool,
    pub stale_source_observed: bool,
    pub tracker_stale: bool,
    pub reservation_conflict: bool,
    pub stale_binary_suspected: bool,
    pub coordination_blocked: bool,
    pub source_authority_ambiguous: bool,
    pub remote_verification_admitted: Option<bool>,
    pub evidence_available: bool,
}

#[must_use]
pub fn environment_attestation_summary_from_inputs(
    inputs: EnvironmentAttestationSummaryInputs,
) -> EnvironmentAttestationSummary {
    let environment_verdict = if inputs.local_cargo_fallback_observed {
        EnvironmentAttestationVerdict::LocalCargoBypassDetected
    } else if inputs.remote_environment_blocked {
        EnvironmentAttestationVerdict::ProofEnvironmentBlocked
    } else if inputs.tracker_stale {
        EnvironmentAttestationVerdict::TrackerStale
    } else if inputs.reservation_conflict {
        EnvironmentAttestationVerdict::UnsafeDueToConflict
    } else if inputs.stale_binary_suspected {
        EnvironmentAttestationVerdict::StaleBinarySuspected
    } else if inputs.coordination_blocked {
        EnvironmentAttestationVerdict::CoordinateBeforeClaim
    } else if inputs.source_authority_ambiguous {
        EnvironmentAttestationVerdict::SourceAuthorityAmbiguous
    } else if inputs.remote_verification_admitted == Some(true) {
        EnvironmentAttestationVerdict::RemoteVerificationAdmitted
    } else if !inputs.evidence_available {
        EnvironmentAttestationVerdict::UnknownInsufficientEvidence
    } else {
        EnvironmentAttestationVerdict::SafeToClaim
    };
    EnvironmentAttestationSummary {
        safe_to_claim: environment_verdict == EnvironmentAttestationVerdict::SafeToClaim
            || environment_verdict == EnvironmentAttestationVerdict::RemoteVerificationAdmitted,
        remote_verification_admitted: inputs.remote_verification_admitted,
        source_test_verdict: if inputs.remote_environment_blocked {
            EnvironmentAttestationSourceTestVerdict::EnvironmentBlockedBeforeSource
        } else if inputs.stale_source_observed {
            EnvironmentAttestationSourceTestVerdict::StaleSource
        } else {
            EnvironmentAttestationSourceTestVerdict::NotEvaluated
        },
        environment_verdict,
        local_cargo_fallback_observed: inputs.local_cargo_fallback_observed,
    }
}

#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Serialize)]
#[serde(rename_all = "snake_case")]
pub enum EnvironmentAttestationVerdict {
    SafeToClaim,
    CoordinateBeforeClaim,
    UnsafeDueToConflict,
    RemoteVerificationAdmitted,
    ProofEnvironmentBlocked,
    SourceAuthorityAmbiguous,
    StaleBinarySuspected,
    TrackerStale,
    LocalCargoBypassDetected,
    UnknownInsufficientEvidence,
}

#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Serialize)]
#[serde(rename_all = "snake_case")]
pub enum EnvironmentAttestationSourceTestVerdict {
    NotEvaluated,
    SourceNotTested,
    SourcePassed,
    SourceFailed,
    EnvironmentBlockedBeforeSource,
    StaleSource,
    Unknown,
}

#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Serialize)]
#[serde(rename_all = "snake_case")]
pub enum EnvironmentAttestationSourceKind {
    InstalledBinary,
    SourceTree,
    BeadsTracker,
    BvRecommendation,
    AgentMailMcp,
    AgentMailProbe,
    Rch,
    RchSourceMaterialization,
    BuildAdmission,
    LocalCargoTripwire,
    CiProofLane,
    HostProfile,
    ClaimGate,
    FileReservations,
    SupportBundleRedaction,
}

#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Serialize)]
#[serde(rename_all = "snake_case")]
pub enum EnvironmentAttestationAuthority {
    Authoritative,
    Advisory,
    Degraded,
    Stale,
    Unavailable,
    Contradicted,
}

#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Serialize)]
#[serde(rename_all = "snake_case")]
pub enum EnvironmentAttestationSourceStatus {
    NotCollected,
    Ok,
    Stale,
    Unavailable,
    Degraded,
    Blocked,
    Contradicted,
    Ambiguous,
    LocalOnly,
    RemoteReady,
    RemoteBlocked,
}

#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Serialize)]
#[serde(rename_all = "snake_case")]
pub enum EnvironmentAttestationFreshness {
    Current,
    Stale,
    Unknown,
    NotApplicable,
}

#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Serialize)]
#[serde(rename_all = "snake_case")]
pub enum EnvironmentAttestationDegradedCode {
    AgentMailUnavailable,
    AgentMailProbeMismatch,
    BeadsTrackerStale,
    BeadsMetadataOnlyStale,
    BvRecommendationStale,
    RchUnavailable,
    RchWorkerTopologyBlocked,
    RchSourceMaterializationBlocked,
    RchRemoteRequiredFallbackPrevented,
    StaleBinarySuspected,
    SourceAuthorityAmbiguous,
    LocalCargoBypassDetected,
    DirtyCheckoutObserved,
    BuildAdmissionBlocked,
    SupportBundleRedactionUnverified,
    ReservationEvidenceStale,
    CiProofLaneArtifactMissing,
    CiProofLaneArtifactStale,
    CiProofLaneCancelledBeforeArtifact,
    CiProofLaneChecksumMismatch,
    CiProofLaneSurfaceProbeFailed,
    CiProofLaneArtifactAttestationInvalid,
    CiProofLaneUnknownSource,
    CiProofLaneDuplicateDispatch,
}

#[derive(Clone, Debug, Eq, PartialEq, Serialize)]
#[serde(rename_all = "camelCase")]
pub struct EnvironmentAttestationSourceAuthorityEntry {
    pub source: EnvironmentAttestationSourceKind,
    pub authority: EnvironmentAttestationAuthority,
    pub status: EnvironmentAttestationSourceStatus,
    pub freshness: EnvironmentAttestationFreshness,
    pub observed_at: Option<String>,
    pub summary: String,
    pub evidence_refs: Vec<String>,
    pub metrics: Vec<EnvironmentAttestationMetric>,
    pub degraded_codes: Vec<EnvironmentAttestationDegradedCode>,
    pub recovery_actions: Vec<EnvironmentAttestationRecoveryAction>,
}

#[derive(Clone, Debug, Eq, Ord, PartialEq, PartialOrd, Serialize)]
#[serde(rename_all = "camelCase")]
pub struct EnvironmentAttestationMetric {
    pub name: String,
    pub value: String,
}

#[derive(Clone, Debug, Eq, Ord, PartialEq, PartialOrd, Serialize)]
#[serde(rename_all = "camelCase")]
pub struct EnvironmentAttestationRecoveryAction {
    pub priority: u8,
    pub kind: EnvironmentAttestationRecoveryKind,
    pub command: Option<EnvironmentAttestationCommandAction>,
    pub mutates_state: bool,
    pub required_substrate: EnvironmentAttestationSubstrate,
    pub rationale: String,
}

#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Serialize)]
#[serde(rename_all = "snake_case")]
pub enum EnvironmentAttestationRecoveryKind {
    Inspect,
    Coordinate,
    Sync,
    Rebuild,
    RerunRemote,
    RepairEnvironment,
    VerifyRedaction,
    HumanDecision,
}

#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Serialize)]
#[serde(rename_all = "snake_case")]
pub enum EnvironmentAttestationSubstrate {
    AgentMail,
    Beads,
    Bv,
    Ee,
    Git,
    Human,
    Rch,
    StaticLocal,
    None,
}

#[derive(Clone, Debug, Eq, Ord, PartialEq, PartialOrd, Serialize)]
#[serde(rename_all = "camelCase")]
pub struct EnvironmentAttestationCommandAction {
    pub display_command: String,
    pub argv: Vec<String>,
    pub shell_required: bool,
    pub copy_safety: EnvironmentAttestationCommandCopySafety,
}

#[derive(Clone, Copy, Debug, Eq, Ord, PartialEq, PartialOrd, Serialize)]
#[serde(rename_all = "snake_case")]
pub enum EnvironmentAttestationCommandCopySafety {
    SafeStructuredArgv,
    DisplayOnly,
    ShellRequiredReview,
    ForbiddenUntilHumanApproval,
}

#[derive(Clone, Debug, Eq, Ord, PartialEq, PartialOrd, Serialize)]
pub struct EnvironmentAttestationDegradation {
    pub code: EnvironmentAttestationDegradedCode,
    pub severity: &'static str,
    pub message: String,
    pub repair: Option<String>,
}

#[derive(Clone, Debug, PartialEq)]
pub struct EnvironmentAttestationInputs<'a> {
    pub generated_at: DateTime<Utc>,
    pub local_cargo_process_scan: Option<&'a Value>,
    pub local_cargo_process_scan_origin: EnvironmentAttestationLocalCargoScanOrigin,
    pub ci_proof_lane_snapshot: Option<&'a Value>,
}

#[derive(Clone, Copy, Debug, Eq, PartialEq)]
pub enum EnvironmentAttestationLocalCargoScanOrigin {
    LiveProbe,
    Fixture,
}

impl EnvironmentAttestationLocalCargoScanOrigin {
    const fn as_str(self) -> &'static str {
        match self {
            Self::LiveProbe => "live_probe",
            Self::Fixture => "fixture",
        }
    }
}

impl EnvironmentAttestationInputs<'_> {
    #[must_use]
    pub fn generated_now() -> Self {
        Self {
            generated_at: Utc::now(),
            local_cargo_process_scan: None,
            local_cargo_process_scan_origin: EnvironmentAttestationLocalCargoScanOrigin::LiveProbe,
            ci_proof_lane_snapshot: None,
        }
    }
}

#[must_use]
pub fn collect_environment_attestation(
    options: &SwarmBriefCollectOptions,
    runner: &impl SwarmBriefCommandRunner,
) -> EnvironmentAttestationReport {
    let report = collect_swarm_brief(options, runner);
    let local_cargo_process_scan =
        crate::core::support_bundle::local_cargo_tripwire_process_scan_json(&options.workspace);
    environment_attestation_from_swarm_brief_with_inputs(
        &report,
        EnvironmentAttestationInputs {
            generated_at: Utc::now(),
            local_cargo_process_scan: Some(&local_cargo_process_scan),
            local_cargo_process_scan_origin: EnvironmentAttestationLocalCargoScanOrigin::LiveProbe,
            ci_proof_lane_snapshot: None,
        },
    )
}

#[must_use]
pub fn environment_attestation_from_swarm_brief(
    report: &SwarmBriefReport,
    generated_at: DateTime<Utc>,
) -> EnvironmentAttestationReport {
    environment_attestation_from_swarm_brief_with_inputs(
        report,
        EnvironmentAttestationInputs {
            generated_at,
            local_cargo_process_scan: None,
            local_cargo_process_scan_origin: EnvironmentAttestationLocalCargoScanOrigin::LiveProbe,
            ci_proof_lane_snapshot: None,
        },
    )
}

#[must_use]
pub fn environment_attestation_from_swarm_brief_with_inputs(
    report: &SwarmBriefReport,
    inputs: EnvironmentAttestationInputs<'_>,
) -> EnvironmentAttestationReport {
    let mut entries = source_authority_entries(report);
    if let Some(process_scan) = inputs.local_cargo_process_scan {
        entries.push(local_cargo_tripwire_entry(
            process_scan,
            inputs.local_cargo_process_scan_origin,
        ));
    }
    if let Some(snapshot) = inputs.ci_proof_lane_snapshot {
        entries.push(ci_proof_lane_entry(snapshot));
    }
    if let Some(entry) = build_admission_entry(report) {
        entries.push(entry);
    }
    if let Some(entry) = file_reservation_entry(report) {
        entries.push(entry);
    }
    entries.sort_by(|left, right| {
        left.source
            .cmp(&right.source)
            .then_with(|| left.summary.cmp(&right.summary))
    });
    entries.dedup_by(|left, right| left.source == right.source);

    let summary = attestation_summary(&entries);
    let verdict = summary.environment_verdict;
    let evidence_refs = collect_evidence_refs(&entries);
    let recovery_actions = collect_recovery_actions(&entries);
    let degraded = collect_degraded_entries(&entries);
    let mut attestation = EnvironmentAttestationReport {
        schema: ENVIRONMENT_ATTESTATION_SCHEMA_V1,
        attestation_id: String::new(),
        workspace: report.workspace.clone(),
        generated_at: inputs.generated_at,
        redaction_status: ENVIRONMENT_ATTESTATION_REDACTION_STATUS,
        summary,
        source_authority: entries,
        verdict,
        evidence_refs,
        recovery_actions,
        degraded,
    };
    attestation.attestation_id = attestation_id(&attestation);
    attestation
}

fn source_authority_entries(
    report: &SwarmBriefReport,
) -> Vec<EnvironmentAttestationSourceAuthorityEntry> {
    let mut entries: Vec<_> = report
        .sources
        .iter()
        .filter_map(|snapshot| source_entry_from_snapshot(report, snapshot))
        .collect();
    if report.sources.is_empty() {
        entries.push(not_collected_entry(
            EnvironmentAttestationSourceKind::ClaimGate,
            "No swarm brief sources were collected.",
            "ee swarm brief --workspace . --include-rch --json",
        ));
    }
    entries
}

fn source_entry_from_snapshot(
    report: &SwarmBriefReport,
    snapshot: &SwarmBriefSourceSnapshot,
) -> Option<EnvironmentAttestationSourceAuthorityEntry> {
    let source = match snapshot.source {
        SwarmBriefSourceKind::AgentInventory
        | SwarmBriefSourceKind::MemoryDrift
        | SwarmBriefSourceKind::Qos
        | SwarmBriefSourceKind::Toolchain => return None,
        SwarmBriefSourceKind::AgentMail => EnvironmentAttestationSourceKind::AgentMailProbe,
        SwarmBriefSourceKind::Beads => EnvironmentAttestationSourceKind::BeadsTracker,
        SwarmBriefSourceKind::Bv => EnvironmentAttestationSourceKind::BvRecommendation,
        SwarmBriefSourceKind::Git => EnvironmentAttestationSourceKind::SourceTree,
        SwarmBriefSourceKind::HostProfile => EnvironmentAttestationSourceKind::HostProfile,
        SwarmBriefSourceKind::Rch => EnvironmentAttestationSourceKind::Rch,
    };
    let degraded_codes = snapshot_degraded_codes(snapshot);
    let mut entry = EnvironmentAttestationSourceAuthorityEntry {
        source,
        authority: snapshot_authority(source, snapshot, &degraded_codes),
        status: snapshot_status(source, snapshot, &degraded_codes),
        freshness: freshness_from_swarm(snapshot.freshness.state),
        observed_at: snapshot.freshness.observed_at.clone(),
        summary: source_summary(report, source, snapshot),
        evidence_refs: source_evidence_refs(source),
        metrics: source_metrics(report, source, snapshot),
        degraded_codes,
        recovery_actions: snapshot_recovery_actions(snapshot),
    };
    if source == EnvironmentAttestationSourceKind::SourceTree && !report.dirty_files.is_empty() {
        insert_degraded_code(
            &mut entry.degraded_codes,
            EnvironmentAttestationDegradedCode::DirtyCheckoutObserved,
        );
        entry.status = EnvironmentAttestationSourceStatus::Degraded;
        entry.authority = EnvironmentAttestationAuthority::Degraded;
        entry
            .recovery_actions
            .push(EnvironmentAttestationRecoveryAction {
                priority: 0,
                kind: EnvironmentAttestationRecoveryKind::Coordinate,
                command: command_action("git status --short --branch --untracked-files=all"),
                mutates_state: false,
                required_substrate: EnvironmentAttestationSubstrate::Git,
                rationale:
                    "Inspect dirty path counts and coordinate before claiming overlapping work."
                        .to_owned(),
            });
    }
    entry.recovery_actions.sort();
    entry.recovery_actions.dedup();
    Some(entry)
}

fn source_summary(
    report: &SwarmBriefReport,
    source: EnvironmentAttestationSourceKind,
    snapshot: &SwarmBriefSourceSnapshot,
) -> String {
    match source {
        EnvironmentAttestationSourceKind::SourceTree => format!(
            "Git source collected with {} dirty path(s) and {} recent commit(s).",
            report.dirty_files.len(),
            report.recent_commits.len()
        ),
        EnvironmentAttestationSourceKind::BeadsTracker => format!(
            "Beads source collected {} ready, {} blocked, {} in-progress, and {} deferred item(s).",
            report.beads.ready.len(),
            report.beads.blocked.len(),
            report.beads.in_progress.len(),
            report.beads.deferred.len()
        ),
        EnvironmentAttestationSourceKind::BvRecommendation => {
            let pick_count = report
                .bv
                .as_ref()
                .map_or(0, |summary| summary.top_picks.len());
            format!("BV source collected {pick_count} top pick(s).")
        }
        EnvironmentAttestationSourceKind::AgentMailProbe => format!(
            "Agent Mail source collected {} reservation(s), {} inbox summary row(s), and {} thread summary row(s).",
            report.file_reservations.len(),
            report.inbox.len(),
            report.threads.len()
        ),
        EnvironmentAttestationSourceKind::Rch => {
            let posture =
                report
                    .rch_local_capability
                    .as_ref()
                    .map_or("not_collected", |capability| {
                        if capability.remote_only_safe {
                            "remote_only_safe"
                        } else if capability.remote_only_required {
                            "remote_required_not_safe"
                        } else {
                            "remote_not_required"
                        }
                    });
            format!(
                "RCH source status={} posture={posture}.",
                snapshot.status.as_str()
            )
        }
        EnvironmentAttestationSourceKind::HostProfile => report.host_profile.as_ref().map_or_else(
            || "Host profile source collected no detailed profile.".to_owned(),
            |summary| {
                format!(
                    "Host profile recommends {} with target-dir posture {}.",
                    summary.recommended_profile, summary.target_dir_posture
                )
            },
        ),
        _ => format!(
            "Source {} collected {} item(s).",
            source.as_str(),
            snapshot.item_count
        ),
    }
}

fn source_metrics(
    report: &SwarmBriefReport,
    source: EnvironmentAttestationSourceKind,
    snapshot: &SwarmBriefSourceSnapshot,
) -> Vec<EnvironmentAttestationMetric> {
    let mut metrics = vec![metric("item_count", snapshot.item_count)];
    match source {
        EnvironmentAttestationSourceKind::SourceTree => {
            metrics.push(metric("dirty_path_count", report.dirty_files.len()));
            metrics.push(metric("recent_commit_count", report.recent_commits.len()));
        }
        EnvironmentAttestationSourceKind::BeadsTracker => {
            metrics.push(metric("ready_count", report.beads.ready.len()));
            metrics.push(metric("blocked_count", report.beads.blocked.len()));
            metrics.push(metric("in_progress_count", report.beads.in_progress.len()));
            metrics.push(metric("deferred_count", report.beads.deferred.len()));
        }
        EnvironmentAttestationSourceKind::AgentMailProbe => {
            metrics.push(metric("reservation_count", report.file_reservations.len()));
            metrics.push(metric("inbox_summary_count", report.inbox.len()));
            metrics.push(metric("thread_summary_count", report.threads.len()));
        }
        EnvironmentAttestationSourceKind::Rch => {
            if let Some(capability) = &report.rch_local_capability {
                metrics.push(metric_bool(
                    "remote_only_required",
                    capability.remote_only_required,
                ));
                metrics.push(metric_bool("remote_only_safe", capability.remote_only_safe));
                metrics.push(metric(
                    "usable_worker_count",
                    capability.worker_pressure.usable_worker_count,
                ));
                metrics.push(metric(
                    "blocked_worker_count",
                    capability.worker_pressure.blocked_worker_count,
                ));
            }
        }
        EnvironmentAttestationSourceKind::HostProfile => {
            if let Some(summary) = &report.host_profile {
                metrics.push(metric_string(
                    "target_dir_posture",
                    summary.target_dir_posture.clone(),
                ));
                metrics.push(metric_bool(
                    "rch_hint_configured",
                    summary.rch_hint_configured,
                ));
            }
        }
        _ => {}
    }
    metrics.sort();
    metrics.dedup();
    metrics
}

fn local_cargo_tripwire_entry(
    process_scan: &Value,
    origin: EnvironmentAttestationLocalCargoScanOrigin,
) -> EnvironmentAttestationSourceAuthorityEntry {
    let status_text = process_scan
        .get("status")
        .and_then(Value::as_str)
        .unwrap_or("unavailable");
    let count = crate::core::support_bundle::local_cargo_tripwire_blocking_count(process_scan);
    let bypass_detected =
        crate::core::support_bundle::local_cargo_tripwire_detected_bypass(process_scan);
    let mut degraded_codes = Vec::new();
    let (authority, status, summary) = if bypass_detected {
        degraded_codes.push(EnvironmentAttestationDegradedCode::LocalCargoBypassDetected);
        (
            EnvironmentAttestationAuthority::Contradicted,
            EnvironmentAttestationSourceStatus::Blocked,
            if origin == EnvironmentAttestationLocalCargoScanOrigin::Fixture {
                format!(
                    "Fixture-supplied local Cargo process scan reported {count} disallowed local build process(es)."
                )
            } else {
                format!(
                    "Local Cargo process scan detected {count} disallowed local build process(es)."
                )
            },
        )
    } else if status_text == "unavailable" {
        degraded_codes.push(EnvironmentAttestationDegradedCode::SourceAuthorityAmbiguous);
        (
            EnvironmentAttestationAuthority::Unavailable,
            EnvironmentAttestationSourceStatus::Unavailable,
            if origin == EnvironmentAttestationLocalCargoScanOrigin::Fixture {
                "Fixture-supplied local Cargo process scan reported unavailable status.".to_owned()
            } else {
                "Local Cargo process scan was unavailable.".to_owned()
            },
        )
    } else {
        (
            EnvironmentAttestationAuthority::Authoritative,
            EnvironmentAttestationSourceStatus::Ok,
            if origin == EnvironmentAttestationLocalCargoScanOrigin::Fixture {
                "Fixture-supplied local Cargo process scan reported no disallowed local build process.".to_owned()
            } else {
                "Local Cargo process scan found no disallowed local build process.".to_owned()
            },
        )
    };
    let evidence_refs = if origin == EnvironmentAttestationLocalCargoScanOrigin::Fixture {
        vec!["fixture://local-cargo-process-scan".to_owned()]
    } else {
        vec!["tripwire://local-cargo-process-scan".to_owned()]
    };
    let mut metrics = vec![metric("detected_local_build_count", count)];
    if origin == EnvironmentAttestationLocalCargoScanOrigin::Fixture {
        metrics.push(metric_string("input_origin", origin.as_str().to_owned()));
    }
    EnvironmentAttestationSourceAuthorityEntry {
        source: EnvironmentAttestationSourceKind::LocalCargoTripwire,
        authority,
        status,
        freshness: EnvironmentAttestationFreshness::Current,
        observed_at: None,
        summary,
        evidence_refs,
        metrics,
        degraded_codes,
        recovery_actions: local_cargo_recovery_actions(bypass_detected, status_text),
    }
}

fn local_cargo_recovery_actions(
    bypass_detected: bool,
    status_text: &str,
) -> Vec<EnvironmentAttestationRecoveryAction> {
    if bypass_detected {
        vec![EnvironmentAttestationRecoveryAction {
            priority: 0,
            kind: EnvironmentAttestationRecoveryKind::HumanDecision,
            command: None,
            mutates_state: false,
            required_substrate: EnvironmentAttestationSubstrate::Human,
            rationale: "Stop and resolve the local Cargo bypass before treating verification as remote-only proof."
                .to_owned(),
        }]
    } else if status_text == "unavailable" {
        vec![EnvironmentAttestationRecoveryAction {
            priority: 1,
            kind: EnvironmentAttestationRecoveryKind::Inspect,
            command: command_action(
                "scripts/check-local-cargo-tripwire.sh --probe-processes --json",
            ),
            mutates_state: false,
            required_substrate: EnvironmentAttestationSubstrate::StaticLocal,
            rationale: "Inspect why the read-only local Cargo process scan was unavailable."
                .to_owned(),
        }]
    } else {
        Vec::new()
    }
}

fn ci_proof_lane_entry(snapshot: &Value) -> EnvironmentAttestationSourceAuthorityEntry {
    let schema_ok = ci_proof_lane_text(snapshot, "/schema") == Some("ee.ci_proof_lane_snapshot.v1");
    let verdict = ci_proof_lane_text(snapshot, "/summary/verdict").unwrap_or("unknown");
    let fresh_artifact_available = snapshot
        .pointer("/summary/freshArtifactAvailable")
        .and_then(Value::as_bool)
        .unwrap_or(false);
    let nested_artifact_verified = ci_proof_lane_artifact_evidence_verified(snapshot);
    let mut degraded_codes = ci_proof_lane_degraded_codes(snapshot);
    if !schema_ok {
        insert_degraded_code(
            &mut degraded_codes,
            EnvironmentAttestationDegradedCode::SourceAuthorityAmbiguous,
        );
    }
    if degraded_codes.is_empty() && !fresh_artifact_available {
        insert_degraded_code(&mut degraded_codes, ci_proof_lane_code_for_verdict(verdict));
    }
    if fresh_artifact_available && !nested_artifact_verified {
        insert_degraded_code(
            &mut degraded_codes,
            EnvironmentAttestationDegradedCode::CiProofLaneArtifactAttestationInvalid,
        );
    }
    degraded_codes.sort();
    degraded_codes.dedup();

    let (authority, status, freshness, summary) = if !schema_ok {
        (
            EnvironmentAttestationAuthority::Unavailable,
            EnvironmentAttestationSourceStatus::Ambiguous,
            EnvironmentAttestationFreshness::Unknown,
            "CI proof lane snapshot schema was not recognized.".to_owned(),
        )
    } else if degraded_codes.is_empty() && fresh_artifact_available && nested_artifact_verified {
        (
            EnvironmentAttestationAuthority::Authoritative,
            EnvironmentAttestationSourceStatus::Ok,
            EnvironmentAttestationFreshness::Current,
            "CI proof lane reports a current-head artifact with verified checksum and surface probe."
                .to_owned(),
        )
    } else if degraded_codes.contains(&EnvironmentAttestationDegradedCode::CiProofLaneArtifactStale)
    {
        (
            EnvironmentAttestationAuthority::Stale,
            EnvironmentAttestationSourceStatus::Stale,
            EnvironmentAttestationFreshness::Stale,
            "CI proof lane artifact source SHA is stale relative to requested head SHA.".to_owned(),
        )
    } else if degraded_codes.contains(&EnvironmentAttestationDegradedCode::CiProofLaneUnknownSource)
        || degraded_codes
            .contains(&EnvironmentAttestationDegradedCode::CiProofLaneDuplicateDispatch)
    {
        (
            EnvironmentAttestationAuthority::Advisory,
            EnvironmentAttestationSourceStatus::Ambiguous,
            EnvironmentAttestationFreshness::Unknown,
            "CI proof lane source authority is ambiguous; do not reuse or dispatch blindly."
                .to_owned(),
        )
    } else {
        (
            EnvironmentAttestationAuthority::Degraded,
            EnvironmentAttestationSourceStatus::Blocked,
            EnvironmentAttestationFreshness::Unknown,
            "CI proof lane did not produce reusable current-head artifact authority.".to_owned(),
        )
    };

    EnvironmentAttestationSourceAuthorityEntry {
        source: EnvironmentAttestationSourceKind::CiProofLane,
        authority,
        status,
        freshness,
        observed_at: ci_proof_lane_observed_at(snapshot),
        summary,
        evidence_refs: vec![format!(
            "ci-proof-lane://snapshot/{}",
            ci_proof_lane_safe_text(
                ci_proof_lane_text(snapshot, "/snapshotId").unwrap_or("unknown")
            )
            .unwrap_or_else(|| "unknown".to_owned())
        )],
        metrics: ci_proof_lane_metrics(snapshot),
        degraded_codes: degraded_codes.clone(),
        recovery_actions: ci_proof_lane_recovery_actions(&degraded_codes),
    }
}

fn ci_proof_lane_observed_at(snapshot: &Value) -> Option<String> {
    let observed_at = ci_proof_lane_text(snapshot, "/generatedAt")?;
    if chrono::DateTime::parse_from_rfc3339(observed_at).is_ok() {
        Some(observed_at.to_owned())
    } else {
        None
    }
}

fn ci_proof_lane_degraded_codes(snapshot: &Value) -> Vec<EnvironmentAttestationDegradedCode> {
    let mut codes = Vec::new();
    if let Some(degraded) = snapshot.get("degraded").and_then(Value::as_array) {
        for item in degraded {
            if let Some(code) = item.get("code").and_then(Value::as_str) {
                insert_degraded_code(&mut codes, map_degraded_code(code));
            }
        }
    }
    codes
}

fn ci_proof_lane_artifact_evidence_verified(snapshot: &Value) -> bool {
    if ci_proof_lane_text(snapshot, "/summary/verdict") != Some("fresh_artifact_available")
        || ci_proof_lane_text(snapshot, "/activeRecommendation/workflowName")
            != Some("macOS EE Artifact")
        || ci_proof_lane_text(snapshot, "/activeRecommendation/nextAction")
            != Some("reuse_verified_artifact")
    {
        return false;
    }
    let (Some(requested_head), Some(recommended_run_id)) = (
        ci_proof_lane_text(snapshot, "/repository/headSha"),
        ci_proof_lane_text(snapshot, "/activeRecommendation/runId"),
    ) else {
        return false;
    };
    let Some(workflows) = snapshot.get("workflows").and_then(Value::as_array) else {
        return false;
    };
    let run = workflows
        .iter()
        .filter(|workflow| {
            workflow.get("workflowName").and_then(Value::as_str) == Some("macOS EE Artifact")
        })
        .filter_map(|workflow| workflow.get("runs").and_then(Value::as_array))
        .flatten()
        .find(|run| {
            run.get("runId").and_then(Value::as_str) == Some(recommended_run_id)
                && run.get("headSha").and_then(Value::as_str) == Some(requested_head)
                && run.get("status").and_then(Value::as_str) == Some("completed")
                && run.get("conclusion").and_then(Value::as_str) == Some("success")
                && run.get("sourceFreshness").and_then(Value::as_str) == Some("current")
                && run.get("artifactFreshness").and_then(Value::as_str) == Some("current")
        });
    let Some(artifact) = run
        .and_then(|run| run.get("artifacts"))
        .and_then(Value::as_array)
        .and_then(|artifacts| {
            artifacts.iter().find(|artifact| {
                artifact.get("name").and_then(Value::as_str)
                    == Some("ee-aarch64-apple-darwin-debug")
            })
        })
    else {
        return false;
    };
    let probes_passed = artifact
        .get("surfaceProbes")
        .and_then(Value::as_array)
        .is_some_and(|probes| {
            const VERSION_ARGV_HASH: &str =
                "sha256:4af47b5e027e1686b124d8c7f986fe44a60b0b8a73c9cf1a32a8d8a592b39b48";
            const HELP_ARGV_HASH: &str =
                "sha256:37fa79e205cce2dafd8ac4da2075f73f74ed03beeca38cc6d741fcf54be21558";
            if probes.len() != 2 {
                return false;
            }
            [
                ("version_json", VERSION_ARGV_HASH),
                ("environment_attestation_help", HELP_ARGV_HASH),
            ]
            .iter()
            .all(|(probe_id, argv_hash)| {
                probes.iter().any(|probe| {
                    probe.get("probeId").and_then(Value::as_str) == Some(*probe_id)
                        && probe.get("status").and_then(Value::as_str) == Some("passed")
                        && probe.get("exitCode").and_then(Value::as_i64) == Some(0)
                        && probe.get("argvHash").and_then(Value::as_str) == Some(*argv_hash)
                        && probe
                            .get("stdoutHash")
                            .and_then(Value::as_str)
                            .is_some_and(is_sha256_hash)
                        && probe
                            .get("stderrHash")
                            .and_then(Value::as_str)
                            .is_some_and(is_sha256_hash)
                })
            })
        });
    let no_rejections = artifact
        .get("attestationRejections")
        .and_then(Value::as_array)
        .is_some_and(Vec::is_empty);
    artifact.get("status").and_then(Value::as_str) == Some("available")
        && artifact.get("checksumStatus").and_then(Value::as_str) == Some("verified")
        && artifact.get("attestationStatus").and_then(Value::as_str) == Some("verified")
        && artifact
            .get("artifactId")
            .and_then(Value::as_str)
            .is_some_and(is_positive_decimal_id)
        && artifact.get("attestedRunId").and_then(Value::as_str) == Some(recommended_run_id)
        && artifact.get("sourceSha").and_then(Value::as_str) == Some(requested_head)
        && artifact.get("attestedSourceCommit").and_then(Value::as_str) == Some(requested_head)
        && artifact
            .get("attestedGitTree")
            .and_then(Value::as_str)
            .is_some_and(is_full_git_object)
        && artifact
            .get("manifestHash")
            .and_then(Value::as_str)
            .is_some_and(is_sha256_hash)
        && artifact
            .get("verificationHash")
            .and_then(Value::as_str)
            .is_some_and(is_sha256_hash)
        && [
            "binaryHash",
            "archiveHash",
            "buildCommandHash",
            "effectiveInputHash",
            "provenanceHash",
        ]
        .iter()
        .all(|field| {
            artifact
                .get(*field)
                .and_then(Value::as_str)
                .is_some_and(is_sha256_hash)
        })
        && probes_passed
        && no_rejections
}

fn is_positive_decimal_id(value: &str) -> bool {
    !value.is_empty()
        && value.as_bytes()[0] != b'0'
        && value.bytes().all(|byte| byte.is_ascii_digit())
}

fn is_full_git_object(value: &str) -> bool {
    value.len() == 40
        && value
            .bytes()
            .all(|byte| byte.is_ascii_digit() || matches!(byte, b'a'..=b'f'))
}

fn is_sha256_hash(value: &str) -> bool {
    value.strip_prefix("sha256:").is_some_and(|digest| {
        digest.len() == 64
            && digest
                .bytes()
                .all(|byte| byte.is_ascii_digit() || matches!(byte, b'a'..=b'f'))
    })
}

fn ci_proof_lane_code_for_verdict(verdict: &str) -> EnvironmentAttestationDegradedCode {
    match verdict {
        "artifact_missing" => EnvironmentAttestationDegradedCode::CiProofLaneArtifactMissing,
        "artifact_stale" => EnvironmentAttestationDegradedCode::CiProofLaneArtifactStale,
        "run_cancelled_before_artifact" => {
            EnvironmentAttestationDegradedCode::CiProofLaneCancelledBeforeArtifact
        }
        "duplicate_dispatch_detected" => {
            EnvironmentAttestationDegradedCode::CiProofLaneDuplicateDispatch
        }
        "checksum_mismatch" => EnvironmentAttestationDegradedCode::CiProofLaneChecksumMismatch,
        "surface_probe_failed" => EnvironmentAttestationDegradedCode::CiProofLaneSurfaceProbeFailed,
        "artifact_attestation_invalid" => {
            EnvironmentAttestationDegradedCode::CiProofLaneArtifactAttestationInvalid
        }
        _ => EnvironmentAttestationDegradedCode::CiProofLaneUnknownSource,
    }
}

fn ci_proof_lane_metrics(snapshot: &Value) -> Vec<EnvironmentAttestationMetric> {
    let recommended_workflow = ci_proof_lane_text(snapshot, "/activeRecommendation/workflowName");
    let recommended_run_id = ci_proof_lane_text(snapshot, "/activeRecommendation/runId");
    let workflow = snapshot
        .get("workflows")
        .and_then(Value::as_array)
        .and_then(|items| {
            items.iter().find(|workflow| {
                workflow.get("workflowName").and_then(Value::as_str)
                    == recommended_workflow.or(Some("macOS EE Artifact"))
            })
        });
    let run = workflow
        .and_then(|value| value.get("runs"))
        .and_then(Value::as_array)
        .and_then(|items| {
            recommended_run_id
                .and_then(|run_id| {
                    items
                        .iter()
                        .find(|run| run.get("runId").and_then(Value::as_str) == Some(run_id))
                })
                .or_else(|| items.first())
        });
    let artifact = run
        .and_then(|value| value.get("artifacts"))
        .and_then(Value::as_array)
        .and_then(|items| items.first());
    let surface_probe = artifact
        .and_then(|value| value.get("surfaceProbes"))
        .and_then(Value::as_array)
        .and_then(|items| items.first());
    let mut metrics = Vec::new();
    push_ci_metric(
        &mut metrics,
        "verdict",
        ci_proof_lane_text(snapshot, "/summary/verdict"),
    );
    push_ci_metric(
        &mut metrics,
        "source_test_verdict",
        ci_proof_lane_text(snapshot, "/summary/sourceTestVerdict"),
    );
    push_ci_metric(
        &mut metrics,
        "requested_head_sha",
        ci_proof_lane_text(snapshot, "/repository/headSha"),
    );
    if let Some(workflow) = workflow {
        push_ci_metric(
            &mut metrics,
            "workflow_name",
            workflow.get("workflowName").and_then(Value::as_str),
        );
        push_ci_metric(
            &mut metrics,
            "workflow_path",
            workflow.get("workflowPath").and_then(Value::as_str),
        );
    }
    if let Some(run) = run {
        push_ci_metric(
            &mut metrics,
            "run_id",
            run.get("runId").and_then(Value::as_str),
        );
        push_ci_metric(
            &mut metrics,
            "job_id",
            run.get("jobIds")
                .and_then(Value::as_array)
                .and_then(|items| items.first())
                .and_then(Value::as_str),
        );
        push_ci_metric(
            &mut metrics,
            "run_head_sha",
            run.get("headSha").and_then(Value::as_str),
        );
        push_ci_metric(
            &mut metrics,
            "source_freshness",
            run.get("sourceFreshness").and_then(Value::as_str),
        );
        push_ci_metric(
            &mut metrics,
            "artifact_freshness",
            run.get("artifactFreshness").and_then(Value::as_str),
        );
        push_ci_metric(
            &mut metrics,
            "first_failure_diagnosis",
            run.get("firstFailureDiagnosis").and_then(Value::as_str),
        );
    }
    if let Some(artifact) = artifact {
        push_ci_metric(
            &mut metrics,
            "artifact_name",
            artifact.get("name").and_then(Value::as_str),
        );
        push_ci_metric(
            &mut metrics,
            "artifact_id",
            artifact.get("artifactId").and_then(Value::as_str),
        );
        push_ci_metric(
            &mut metrics,
            "checksum_status",
            artifact.get("checksumStatus").and_then(Value::as_str),
        );
        push_ci_metric(
            &mut metrics,
            "artifact_source_sha",
            artifact.get("sourceSha").and_then(Value::as_str),
        );
        push_ci_metric(
            &mut metrics,
            "artifact_attestation_status",
            artifact.get("attestationStatus").and_then(Value::as_str),
        );
        push_ci_metric(
            &mut metrics,
            "attested_source_commit",
            artifact.get("attestedSourceCommit").and_then(Value::as_str),
        );
        push_ci_metric(
            &mut metrics,
            "attested_git_tree",
            artifact.get("attestedGitTree").and_then(Value::as_str),
        );
        push_ci_metric(
            &mut metrics,
            "artifact_manifest_hash",
            artifact.get("manifestHash").and_then(Value::as_str),
        );
        push_ci_metric(
            &mut metrics,
            "artifact_verification_hash",
            artifact.get("verificationHash").and_then(Value::as_str),
        );
        for (name, field) in [
            ("attested_run_id", "attestedRunId"),
            ("artifact_binary_hash", "binaryHash"),
            ("artifact_archive_hash", "archiveHash"),
            ("artifact_build_command_hash", "buildCommandHash"),
            ("artifact_effective_input_hash", "effectiveInputHash"),
            ("artifact_provenance_hash", "provenanceHash"),
        ] {
            push_ci_metric(
                &mut metrics,
                name,
                artifact.get(field).and_then(Value::as_str),
            );
        }
    }
    if let Some(surface_probe) = surface_probe {
        push_ci_metric(
            &mut metrics,
            "surface_probe_status",
            surface_probe.get("status").and_then(Value::as_str),
        );
        push_ci_metric(
            &mut metrics,
            "surface_expected",
            surface_probe.get("expectedSurface").and_then(Value::as_str),
        );
        push_ci_metric(
            &mut metrics,
            "surface_first_failure_diagnosis",
            surface_probe
                .get("firstFailureDiagnosis")
                .and_then(Value::as_str),
        );
    }
    metrics.sort();
    metrics.dedup();
    metrics
}

fn push_ci_metric(
    metrics: &mut Vec<EnvironmentAttestationMetric>,
    name: &str,
    value: Option<&str>,
) {
    if let Some(value) = value.and_then(ci_proof_lane_safe_text) {
        metrics.push(metric_string(name, value));
    }
}

fn ci_proof_lane_text<'a>(value: &'a Value, pointer: &str) -> Option<&'a str> {
    value.pointer(pointer).and_then(Value::as_str)
}

fn ci_proof_lane_safe_text(value: &str) -> Option<String> {
    let text = value
        .trim()
        .replace('\n', " ")
        .replace('\r', " ")
        .replace('\t', " ");
    if text.is_empty() {
        return None;
    }
    let denied = [
        "BEGIN PRIVATE KEY",
        "BEGIN OPENSSH PRIVATE KEY",
        "ghp_",
        "Bearer ",
        "DATABASE_URL=",
        "From: ",
        "Subject: ",
        "Message-ID:",
        "body:",
        "raw_inbox",
        "stdout:",
        "stderr:",
        "/Users/",
        "/home/",
        "/private/",
        "/Volumes/",
    ];
    if denied.iter().any(|pattern| text.contains(pattern)) {
        return Some("redacted_ci_proof_lane_value".to_owned());
    }
    Some(text.chars().take(240).collect())
}

fn ci_proof_lane_recovery_actions(
    codes: &[EnvironmentAttestationDegradedCode],
) -> Vec<EnvironmentAttestationRecoveryAction> {
    if codes.is_empty() {
        return Vec::new();
    }
    let (kind, required_substrate, rationale) = if codes
        .contains(&EnvironmentAttestationDegradedCode::CiProofLaneArtifactStale)
        || codes.contains(&EnvironmentAttestationDegradedCode::CiProofLaneUnknownSource)
        || codes.contains(&EnvironmentAttestationDegradedCode::CiProofLaneDuplicateDispatch)
    {
        (
            EnvironmentAttestationRecoveryKind::Coordinate,
            EnvironmentAttestationSubstrate::AgentMail,
            "Coordinate proof-lane authority before dispatching, downloading, or reusing an artifact.",
        )
    } else {
        (
            EnvironmentAttestationRecoveryKind::HumanDecision,
            EnvironmentAttestationSubstrate::Human,
            "Treat the proof-lane artifact as unavailable until workflow evidence is repaired.",
        )
    };
    vec![EnvironmentAttestationRecoveryAction {
        priority: 0,
        kind,
        command: None,
        mutates_state: false,
        required_substrate,
        rationale: rationale.to_owned(),
    }]
}

fn build_admission_entry(
    report: &SwarmBriefReport,
) -> Option<EnvironmentAttestationSourceAuthorityEntry> {
    let capability = report.rch_local_capability.as_ref()?;
    let mut degraded_codes = Vec::new();
    let (authority, status, summary) = if capability.remote_only_safe {
        (
            EnvironmentAttestationAuthority::Authoritative,
            EnvironmentAttestationSourceStatus::RemoteReady,
            "Build admission permits remote-only Cargo verification from this shell.".to_owned(),
        )
    } else {
        degraded_codes.push(EnvironmentAttestationDegradedCode::BuildAdmissionBlocked);
        (
            EnvironmentAttestationAuthority::Degraded,
            EnvironmentAttestationSourceStatus::Blocked,
            "Build admission does not permit remote-only Cargo verification from this shell."
                .to_owned(),
        )
    };
    let recovery_actions = if capability.remote_only_safe {
        Vec::new()
    } else {
        vec![EnvironmentAttestationRecoveryAction {
            priority: 0,
            kind: EnvironmentAttestationRecoveryKind::RepairEnvironment,
            command: command_action("rch status --json"),
            mutates_state: false,
            required_substrate: EnvironmentAttestationSubstrate::Rch,
            rationale: "Repair RCH readiness before launching Cargo verification.".to_owned(),
        }]
    };
    Some(EnvironmentAttestationSourceAuthorityEntry {
        source: EnvironmentAttestationSourceKind::BuildAdmission,
        authority,
        status,
        freshness: EnvironmentAttestationFreshness::Current,
        observed_at: None,
        summary,
        evidence_refs: vec!["swarm-brief://rch-local-capability".to_owned()],
        metrics: vec![
            metric_bool("remote_only_required", capability.remote_only_required),
            metric_bool("remote_only_safe", capability.remote_only_safe),
        ],
        degraded_codes,
        recovery_actions,
    })
}

fn file_reservation_entry(
    report: &SwarmBriefReport,
) -> Option<EnvironmentAttestationSourceAuthorityEntry> {
    if report.file_reservations.is_empty()
        && source_status(report, SwarmBriefSourceKind::AgentMail).is_none()
    {
        return None;
    }
    let exclusive_count = report
        .file_reservations
        .iter()
        .filter(|reservation| reservation.exclusive)
        .count();
    let mut degraded_codes = Vec::new();
    let (authority, status) = if exclusive_count > 0 {
        degraded_codes.push(EnvironmentAttestationDegradedCode::ReservationEvidenceStale);
        (
            EnvironmentAttestationAuthority::Advisory,
            EnvironmentAttestationSourceStatus::Blocked,
        )
    } else {
        (
            EnvironmentAttestationAuthority::Authoritative,
            EnvironmentAttestationSourceStatus::Ok,
        )
    };
    let recovery_actions = if exclusive_count > 0 {
        vec![EnvironmentAttestationRecoveryAction {
            priority: 0,
            kind: EnvironmentAttestationRecoveryKind::Coordinate,
            command: None,
            mutates_state: false,
            required_substrate: EnvironmentAttestationSubstrate::AgentMail,
            rationale: "Coordinate active file reservations before claiming overlapping surfaces."
                .to_owned(),
        }]
    } else {
        Vec::new()
    };
    Some(EnvironmentAttestationSourceAuthorityEntry {
        source: EnvironmentAttestationSourceKind::FileReservations,
        authority,
        status,
        freshness: EnvironmentAttestationFreshness::Current,
        observed_at: None,
        summary: format!(
            "File reservation source reports {} active reservation(s), {} exclusive.",
            report.file_reservations.len(),
            exclusive_count
        ),
        evidence_refs: vec!["agent-mail://file-reservations".to_owned()],
        metrics: vec![
            metric("active_reservation_count", report.file_reservations.len()),
            metric("exclusive_reservation_count", exclusive_count),
        ],
        degraded_codes,
        recovery_actions,
    })
}

fn source_status(
    report: &SwarmBriefReport,
    source: SwarmBriefSourceKind,
) -> Option<SwarmBriefSourceStatus> {
    report
        .sources
        .iter()
        .find(|snapshot| snapshot.source == source)
        .map(|snapshot| snapshot.status)
}

fn snapshot_degraded_codes(
    snapshot: &SwarmBriefSourceSnapshot,
) -> Vec<EnvironmentAttestationDegradedCode> {
    let mut codes = Vec::new();
    for degraded in &snapshot.degraded {
        insert_degraded_code(&mut codes, map_degraded_code(&degraded.code));
    }
    codes.sort();
    codes.dedup();
    codes
}

fn map_degraded_code(code: &str) -> EnvironmentAttestationDegradedCode {
    match code {
        "agent_mail_unavailable" => EnvironmentAttestationDegradedCode::AgentMailUnavailable,
        "agent_mail_semantic_readiness_failed" | "agent_mail_probe_mismatch" => {
            EnvironmentAttestationDegradedCode::AgentMailProbeMismatch
        }
        "beads_tracker_stale" => EnvironmentAttestationDegradedCode::BeadsTrackerStale,
        "beads_tracker_metadata_drift" | "beads_metadata_only_stale" => {
            EnvironmentAttestationDegradedCode::BeadsMetadataOnlyStale
        }
        "bv_command_timeout" | "bv_no_output" | "bv_unavailable" | "bv_recommendation_stale" => {
            EnvironmentAttestationDegradedCode::BvRecommendationStale
        }
        "rch_unavailable" => EnvironmentAttestationDegradedCode::RchUnavailable,
        "rch_worker_topology_blocked" => {
            EnvironmentAttestationDegradedCode::RchWorkerTopologyBlocked
        }
        "rch_source_materialization_blocked" => {
            EnvironmentAttestationDegradedCode::RchSourceMaterializationBlocked
        }
        "rch_remote_required_fallback_prevented" => {
            EnvironmentAttestationDegradedCode::RchRemoteRequiredFallbackPrevented
        }
        "stale_binary_suspected" => EnvironmentAttestationDegradedCode::StaleBinarySuspected,
        "local_cargo_bypass_detected" => {
            EnvironmentAttestationDegradedCode::LocalCargoBypassDetected
        }
        "dirty_checkout_observed" => EnvironmentAttestationDegradedCode::DirtyCheckoutObserved,
        "build_admission_blocked" => EnvironmentAttestationDegradedCode::BuildAdmissionBlocked,
        "support_bundle_redaction_unverified" => {
            EnvironmentAttestationDegradedCode::SupportBundleRedactionUnverified
        }
        "reservation_evidence_stale" => {
            EnvironmentAttestationDegradedCode::ReservationEvidenceStale
        }
        "ci_proof_lane_artifact_missing" => {
            EnvironmentAttestationDegradedCode::CiProofLaneArtifactMissing
        }
        "ci_proof_lane_artifact_stale" => {
            EnvironmentAttestationDegradedCode::CiProofLaneArtifactStale
        }
        "ci_proof_lane_cancelled_before_artifact" => {
            EnvironmentAttestationDegradedCode::CiProofLaneCancelledBeforeArtifact
        }
        "ci_proof_lane_checksum_mismatch" => {
            EnvironmentAttestationDegradedCode::CiProofLaneChecksumMismatch
        }
        "ci_proof_lane_surface_probe_failed" => {
            EnvironmentAttestationDegradedCode::CiProofLaneSurfaceProbeFailed
        }
        "ci_proof_lane_artifact_attestation_invalid" => {
            EnvironmentAttestationDegradedCode::CiProofLaneArtifactAttestationInvalid
        }
        "ci_proof_lane_duplicate_dispatch" => {
            EnvironmentAttestationDegradedCode::CiProofLaneDuplicateDispatch
        }
        "ci_proof_lane_gh_unavailable" | "ci_proof_lane_no_matching_run" => {
            EnvironmentAttestationDegradedCode::CiProofLaneUnknownSource
        }
        _ => EnvironmentAttestationDegradedCode::SourceAuthorityAmbiguous,
    }
}

fn snapshot_authority(
    source: EnvironmentAttestationSourceKind,
    snapshot: &SwarmBriefSourceSnapshot,
    degraded_codes: &[EnvironmentAttestationDegradedCode],
) -> EnvironmentAttestationAuthority {
    if degraded_codes.contains(&EnvironmentAttestationDegradedCode::BeadsMetadataOnlyStale) {
        return EnvironmentAttestationAuthority::Authoritative;
    }
    if degraded_codes.contains(&EnvironmentAttestationDegradedCode::BeadsTrackerStale) {
        return EnvironmentAttestationAuthority::Stale;
    }
    if degraded_codes.contains(&EnvironmentAttestationDegradedCode::RchWorkerTopologyBlocked)
        || degraded_codes
            .contains(&EnvironmentAttestationDegradedCode::RchRemoteRequiredFallbackPrevented)
        || degraded_codes
            .contains(&EnvironmentAttestationDegradedCode::RchSourceMaterializationBlocked)
    {
        return EnvironmentAttestationAuthority::Degraded;
    }
    match snapshot.status {
        SwarmBriefSourceStatus::Ready => match source {
            EnvironmentAttestationSourceKind::BvRecommendation
            | EnvironmentAttestationSourceKind::HostProfile => {
                EnvironmentAttestationAuthority::Advisory
            }
            _ => EnvironmentAttestationAuthority::Authoritative,
        },
        SwarmBriefSourceStatus::Degraded => EnvironmentAttestationAuthority::Degraded,
        SwarmBriefSourceStatus::Unavailable | SwarmBriefSourceStatus::NotConfigured => {
            EnvironmentAttestationAuthority::Unavailable
        }
        SwarmBriefSourceStatus::Skipped => EnvironmentAttestationAuthority::Unavailable,
    }
}

fn snapshot_status(
    source: EnvironmentAttestationSourceKind,
    snapshot: &SwarmBriefSourceSnapshot,
    degraded_codes: &[EnvironmentAttestationDegradedCode],
) -> EnvironmentAttestationSourceStatus {
    if degraded_codes.contains(&EnvironmentAttestationDegradedCode::BeadsMetadataOnlyStale) {
        return EnvironmentAttestationSourceStatus::Degraded;
    }
    if degraded_codes.contains(&EnvironmentAttestationDegradedCode::BeadsTrackerStale) {
        return EnvironmentAttestationSourceStatus::Stale;
    }
    if degraded_codes.contains(&EnvironmentAttestationDegradedCode::RchWorkerTopologyBlocked)
        || degraded_codes
            .contains(&EnvironmentAttestationDegradedCode::RchRemoteRequiredFallbackPrevented)
        || degraded_codes
            .contains(&EnvironmentAttestationDegradedCode::RchSourceMaterializationBlocked)
    {
        return EnvironmentAttestationSourceStatus::RemoteBlocked;
    }
    match snapshot.status {
        SwarmBriefSourceStatus::Ready => {
            if source == EnvironmentAttestationSourceKind::Rch {
                EnvironmentAttestationSourceStatus::RemoteReady
            } else if snapshot.freshness.state == "stale" {
                EnvironmentAttestationSourceStatus::Stale
            } else {
                EnvironmentAttestationSourceStatus::Ok
            }
        }
        SwarmBriefSourceStatus::Degraded => EnvironmentAttestationSourceStatus::Degraded,
        SwarmBriefSourceStatus::Unavailable | SwarmBriefSourceStatus::NotConfigured => {
            EnvironmentAttestationSourceStatus::Unavailable
        }
        SwarmBriefSourceStatus::Skipped => EnvironmentAttestationSourceStatus::NotCollected,
    }
}

fn freshness_from_swarm(state: &str) -> EnvironmentAttestationFreshness {
    match state {
        "current" => EnvironmentAttestationFreshness::Current,
        "stale" => EnvironmentAttestationFreshness::Stale,
        "not_applicable" => EnvironmentAttestationFreshness::NotApplicable,
        _ => EnvironmentAttestationFreshness::Unknown,
    }
}

fn snapshot_recovery_actions(
    snapshot: &SwarmBriefSourceSnapshot,
) -> Vec<EnvironmentAttestationRecoveryAction> {
    let mut actions: Vec<_> = snapshot
        .degraded
        .iter()
        .enumerate()
        .map(|(index, degraded)| recovery_action_for_degradation(index as u8, degraded))
        .collect();
    actions.sort();
    actions.dedup();
    actions
}

fn recovery_action_for_degradation(
    priority: u8,
    degraded: &SwarmBriefDegradation,
) -> EnvironmentAttestationRecoveryAction {
    match map_degraded_code(&degraded.code) {
        EnvironmentAttestationDegradedCode::BeadsMetadataOnlyStale => {
            EnvironmentAttestationRecoveryAction {
                priority,
                kind: EnvironmentAttestationRecoveryKind::Sync,
                command: command_action("br sync --import-only --json"),
                mutates_state: true,
                required_substrate: EnvironmentAttestationSubstrate::Beads,
                rationale: "Import pending tracker metadata before using Beads as claim authority."
                    .to_owned(),
            }
        }
        EnvironmentAttestationDegradedCode::BeadsTrackerStale => {
            EnvironmentAttestationRecoveryAction {
                priority,
                kind: EnvironmentAttestationRecoveryKind::Sync,
                command: command_action("br sync --import-only"),
                mutates_state: true,
                required_substrate: EnvironmentAttestationSubstrate::Beads,
                rationale: "Import pending tracker records before using Beads as claim authority."
                    .to_owned(),
            }
        }
        EnvironmentAttestationDegradedCode::RchWorkerTopologyBlocked
        | EnvironmentAttestationDegradedCode::RchSourceMaterializationBlocked
        | EnvironmentAttestationDegradedCode::RchRemoteRequiredFallbackPrevented
        | EnvironmentAttestationDegradedCode::RchUnavailable => {
            EnvironmentAttestationRecoveryAction {
                priority,
                kind: EnvironmentAttestationRecoveryKind::RepairEnvironment,
                command: command_action("rch status --json"),
                mutates_state: false,
                required_substrate: EnvironmentAttestationSubstrate::Rch,
                rationale:
                    "Repair RCH readiness before treating remote Cargo verification as source evidence."
                        .to_owned(),
            }
        }
        EnvironmentAttestationDegradedCode::AgentMailUnavailable
        | EnvironmentAttestationDegradedCode::AgentMailProbeMismatch => {
            EnvironmentAttestationRecoveryAction {
                priority,
                kind: EnvironmentAttestationRecoveryKind::Coordinate,
                command: command_action(agent_mail_snapshot_producer_command_template()),
                mutates_state: false,
                required_substrate: EnvironmentAttestationSubstrate::AgentMail,
                rationale: "Generate a redacted Agent Mail snapshot before treating coordination as empty."
                    .to_owned(),
            }
        }
        EnvironmentAttestationDegradedCode::BvRecommendationStale => {
            EnvironmentAttestationRecoveryAction {
                priority,
                kind: EnvironmentAttestationRecoveryKind::Inspect,
                command: command_action("br --no-auto-import --allow-stale ready --json"),
                mutates_state: false,
                required_substrate: EnvironmentAttestationSubstrate::Beads,
                rationale: "Use bounded Beads fallback when BV recommendation evidence is stale."
                    .to_owned(),
            }
        }
        EnvironmentAttestationDegradedCode::DirtyCheckoutObserved
        | EnvironmentAttestationDegradedCode::ReservationEvidenceStale
        | EnvironmentAttestationDegradedCode::SourceAuthorityAmbiguous
        | EnvironmentAttestationDegradedCode::StaleBinarySuspected
        | EnvironmentAttestationDegradedCode::CiProofLaneArtifactMissing
        | EnvironmentAttestationDegradedCode::CiProofLaneArtifactStale
        | EnvironmentAttestationDegradedCode::CiProofLaneCancelledBeforeArtifact
        | EnvironmentAttestationDegradedCode::CiProofLaneChecksumMismatch
        | EnvironmentAttestationDegradedCode::CiProofLaneSurfaceProbeFailed
        | EnvironmentAttestationDegradedCode::CiProofLaneArtifactAttestationInvalid
        | EnvironmentAttestationDegradedCode::CiProofLaneUnknownSource
        | EnvironmentAttestationDegradedCode::CiProofLaneDuplicateDispatch
        | EnvironmentAttestationDegradedCode::BuildAdmissionBlocked
        | EnvironmentAttestationDegradedCode::SupportBundleRedactionUnverified
        | EnvironmentAttestationDegradedCode::LocalCargoBypassDetected => {
            EnvironmentAttestationRecoveryAction {
                priority,
                kind: EnvironmentAttestationRecoveryKind::Inspect,
                command: degraded.repair.as_deref().and_then(command_action),
                mutates_state: false,
                required_substrate: EnvironmentAttestationSubstrate::StaticLocal,
                rationale: degraded.message.clone(),
            }
        }
    }
}

fn attestation_summary(
    entries: &[EnvironmentAttestationSourceAuthorityEntry],
) -> EnvironmentAttestationSummary {
    let codes = all_degraded_codes(entries);
    let local_cargo_fallback_observed =
        codes.contains(&EnvironmentAttestationDegradedCode::LocalCargoBypassDetected);
    let remote_environment_blocked = codes
        .contains(&EnvironmentAttestationDegradedCode::RchWorkerTopologyBlocked)
        || codes.contains(&EnvironmentAttestationDegradedCode::RchSourceMaterializationBlocked)
        || codes.contains(&EnvironmentAttestationDegradedCode::RchRemoteRequiredFallbackPrevented)
        || codes.contains(&EnvironmentAttestationDegradedCode::BuildAdmissionBlocked);
    let remote_verification_admitted = remote_verification_admitted(entries);
    environment_attestation_summary_from_inputs(EnvironmentAttestationSummaryInputs {
        local_cargo_fallback_observed,
        remote_environment_blocked,
        stale_source_observed: codes
            .contains(&EnvironmentAttestationDegradedCode::CiProofLaneArtifactStale),
        tracker_stale: codes.contains(&EnvironmentAttestationDegradedCode::BeadsTrackerStale),
        reservation_conflict: codes
            .contains(&EnvironmentAttestationDegradedCode::ReservationEvidenceStale),
        stale_binary_suspected: codes
            .contains(&EnvironmentAttestationDegradedCode::StaleBinarySuspected),
        coordination_blocked: codes
            .contains(&EnvironmentAttestationDegradedCode::DirtyCheckoutObserved)
            || codes.contains(&EnvironmentAttestationDegradedCode::BvRecommendationStale)
            || codes.contains(&EnvironmentAttestationDegradedCode::AgentMailUnavailable)
            || codes.contains(&EnvironmentAttestationDegradedCode::AgentMailProbeMismatch),
        source_authority_ambiguous: codes
            .contains(&EnvironmentAttestationDegradedCode::SourceAuthorityAmbiguous)
            || codes.contains(&EnvironmentAttestationDegradedCode::CiProofLaneArtifactMissing)
            || codes.contains(&EnvironmentAttestationDegradedCode::CiProofLaneArtifactStale)
            || codes
                .contains(&EnvironmentAttestationDegradedCode::CiProofLaneCancelledBeforeArtifact)
            || codes.contains(&EnvironmentAttestationDegradedCode::CiProofLaneChecksumMismatch)
            || codes.contains(&EnvironmentAttestationDegradedCode::CiProofLaneSurfaceProbeFailed)
            || codes.contains(
                &EnvironmentAttestationDegradedCode::CiProofLaneArtifactAttestationInvalid,
            )
            || codes.contains(&EnvironmentAttestationDegradedCode::CiProofLaneUnknownSource)
            || codes.contains(&EnvironmentAttestationDegradedCode::CiProofLaneDuplicateDispatch),
        remote_verification_admitted,
        evidence_available: !entries.is_empty(),
    })
}

fn all_degraded_codes(
    entries: &[EnvironmentAttestationSourceAuthorityEntry],
) -> BTreeSet<EnvironmentAttestationDegradedCode> {
    entries
        .iter()
        .flat_map(|entry| entry.degraded_codes.iter().copied())
        .collect()
}

fn remote_verification_admitted(
    entries: &[EnvironmentAttestationSourceAuthorityEntry],
) -> Option<bool> {
    let build = entries
        .iter()
        .find(|entry| entry.source == EnvironmentAttestationSourceKind::BuildAdmission);
    if let Some(entry) = build {
        return Some(entry.status == EnvironmentAttestationSourceStatus::RemoteReady);
    }
    let rch = entries
        .iter()
        .find(|entry| entry.source == EnvironmentAttestationSourceKind::Rch)?;
    match rch.status {
        EnvironmentAttestationSourceStatus::RemoteReady => Some(true),
        EnvironmentAttestationSourceStatus::RemoteBlocked
        | EnvironmentAttestationSourceStatus::Blocked
        | EnvironmentAttestationSourceStatus::Unavailable => Some(false),
        _ => None,
    }
}

fn collect_evidence_refs(entries: &[EnvironmentAttestationSourceAuthorityEntry]) -> Vec<String> {
    let mut refs: Vec<_> = entries
        .iter()
        .flat_map(|entry| entry.evidence_refs.iter().cloned())
        .collect();
    refs.sort();
    refs.dedup();
    refs
}

fn collect_recovery_actions(
    entries: &[EnvironmentAttestationSourceAuthorityEntry],
) -> Vec<EnvironmentAttestationRecoveryAction> {
    let mut actions: Vec<_> = entries
        .iter()
        .flat_map(|entry| entry.recovery_actions.iter().cloned())
        .collect();
    actions.sort();
    actions.dedup();
    actions
}

fn collect_degraded_entries(
    entries: &[EnvironmentAttestationSourceAuthorityEntry],
) -> Vec<EnvironmentAttestationDegradation> {
    let mut degraded = Vec::new();
    for entry in entries {
        for code in &entry.degraded_codes {
            degraded.push(EnvironmentAttestationDegradation {
                code: *code,
                severity: severity_for_degraded_code(*code),
                message: degradation_message(*code),
                repair: repair_for_degraded_code(*code),
            });
        }
    }
    degraded.sort();
    degraded.dedup();
    degraded
}

fn severity_for_degraded_code(code: EnvironmentAttestationDegradedCode) -> &'static str {
    match code {
        EnvironmentAttestationDegradedCode::LocalCargoBypassDetected
        | EnvironmentAttestationDegradedCode::RchWorkerTopologyBlocked
        | EnvironmentAttestationDegradedCode::RchSourceMaterializationBlocked
        | EnvironmentAttestationDegradedCode::RchRemoteRequiredFallbackPrevented
        | EnvironmentAttestationDegradedCode::BuildAdmissionBlocked
        | EnvironmentAttestationDegradedCode::CiProofLaneChecksumMismatch
        | EnvironmentAttestationDegradedCode::CiProofLaneSurfaceProbeFailed
        | EnvironmentAttestationDegradedCode::CiProofLaneArtifactAttestationInvalid => "high",
        _ => "warning",
    }
}

fn degradation_message(code: EnvironmentAttestationDegradedCode) -> String {
    match code {
        EnvironmentAttestationDegradedCode::AgentMailUnavailable => {
            "Agent Mail evidence was unavailable; do not treat coordination as empty."
        }
        EnvironmentAttestationDegradedCode::AgentMailProbeMismatch => {
            "Agent Mail probe and semantic readiness evidence disagreed."
        }
        EnvironmentAttestationDegradedCode::BeadsTrackerStale => {
            "Beads tracker content may be stale relative to JSONL."
        }
        EnvironmentAttestationDegradedCode::BeadsMetadataOnlyStale => {
            "Beads tracker metadata is stale while content remains synchronized."
        }
        EnvironmentAttestationDegradedCode::BvRecommendationStale => {
            "BV recommendation evidence was stale or unavailable."
        }
        EnvironmentAttestationDegradedCode::RchUnavailable => {
            "RCH status evidence was unavailable."
        }
        EnvironmentAttestationDegradedCode::RchWorkerTopologyBlocked => {
            "Remote verification was blocked before Cargo by RCH topology."
        }
        EnvironmentAttestationDegradedCode::RchSourceMaterializationBlocked => {
            "Remote verification source materialization was blocked before Cargo."
        }
        EnvironmentAttestationDegradedCode::RchRemoteRequiredFallbackPrevented => {
            "RCH remote-required mode prevented invalid local fallback."
        }
        EnvironmentAttestationDegradedCode::StaleBinarySuspected => {
            "Installed binary surface does not match current source contract."
        }
        EnvironmentAttestationDegradedCode::SourceAuthorityAmbiguous => {
            "At least one source could not be mapped to authoritative evidence."
        }
        EnvironmentAttestationDegradedCode::LocalCargoBypassDetected => {
            "Local Cargo process scan detected a local verification bypass."
        }
        EnvironmentAttestationDegradedCode::DirtyCheckoutObserved => {
            "Dirty checkout paths were observed."
        }
        EnvironmentAttestationDegradedCode::BuildAdmissionBlocked => {
            "Build admission blocked remote-only Cargo verification."
        }
        EnvironmentAttestationDegradedCode::SupportBundleRedactionUnverified => {
            "Support bundle redaction posture was not verified."
        }
        EnvironmentAttestationDegradedCode::ReservationEvidenceStale => {
            "Active file reservation evidence requires coordination."
        }
        EnvironmentAttestationDegradedCode::CiProofLaneArtifactMissing => {
            "CI proof-lane run completed without the expected artifact."
        }
        EnvironmentAttestationDegradedCode::CiProofLaneArtifactStale => {
            "CI proof-lane artifact source SHA is stale relative to requested head SHA."
        }
        EnvironmentAttestationDegradedCode::CiProofLaneCancelledBeforeArtifact => {
            "CI proof-lane run was cancelled before artifact upload completed."
        }
        EnvironmentAttestationDegradedCode::CiProofLaneChecksumMismatch => {
            "CI proof-lane artifact checksum did not verify."
        }
        EnvironmentAttestationDegradedCode::CiProofLaneSurfaceProbeFailed => {
            "CI proof-lane artifact failed the required command-surface probe."
        }
        EnvironmentAttestationDegradedCode::CiProofLaneArtifactAttestationInvalid => {
            "CI proof-lane artifact attestation did not match its source, build inputs, command, packaged bytes, or behavior probe."
        }
        EnvironmentAttestationDegradedCode::CiProofLaneUnknownSource => {
            "CI proof-lane source authority was unavailable or unknown."
        }
        EnvironmentAttestationDegradedCode::CiProofLaneDuplicateDispatch => {
            "Multiple active CI proof-lane dispatches target the same source authority."
        }
    }
    .to_owned()
}

fn repair_for_degraded_code(code: EnvironmentAttestationDegradedCode) -> Option<String> {
    match code {
        EnvironmentAttestationDegradedCode::BeadsTrackerStale => {
            Some("br sync --import-only".to_owned())
        }
        EnvironmentAttestationDegradedCode::BeadsMetadataOnlyStale => {
            Some("br sync --import-only --json".to_owned())
        }
        EnvironmentAttestationDegradedCode::BvRecommendationStale => {
            Some("br --no-auto-import --allow-stale ready --json".to_owned())
        }
        EnvironmentAttestationDegradedCode::RchUnavailable
        | EnvironmentAttestationDegradedCode::RchWorkerTopologyBlocked
        | EnvironmentAttestationDegradedCode::RchSourceMaterializationBlocked
        | EnvironmentAttestationDegradedCode::RchRemoteRequiredFallbackPrevented
        | EnvironmentAttestationDegradedCode::BuildAdmissionBlocked => {
            Some("rch status --json".to_owned())
        }
        EnvironmentAttestationDegradedCode::DirtyCheckoutObserved => {
            Some("git status --short --branch --untracked-files=all".to_owned())
        }
        EnvironmentAttestationDegradedCode::AgentMailUnavailable
        | EnvironmentAttestationDegradedCode::AgentMailProbeMismatch
        | EnvironmentAttestationDegradedCode::StaleBinarySuspected
        | EnvironmentAttestationDegradedCode::SourceAuthorityAmbiguous
        | EnvironmentAttestationDegradedCode::LocalCargoBypassDetected
        | EnvironmentAttestationDegradedCode::SupportBundleRedactionUnverified
        | EnvironmentAttestationDegradedCode::ReservationEvidenceStale
        | EnvironmentAttestationDegradedCode::CiProofLaneArtifactMissing
        | EnvironmentAttestationDegradedCode::CiProofLaneArtifactStale
        | EnvironmentAttestationDegradedCode::CiProofLaneCancelledBeforeArtifact
        | EnvironmentAttestationDegradedCode::CiProofLaneChecksumMismatch
        | EnvironmentAttestationDegradedCode::CiProofLaneSurfaceProbeFailed
        | EnvironmentAttestationDegradedCode::CiProofLaneArtifactAttestationInvalid
        | EnvironmentAttestationDegradedCode::CiProofLaneUnknownSource
        | EnvironmentAttestationDegradedCode::CiProofLaneDuplicateDispatch => None,
    }
}

fn source_evidence_refs(source: EnvironmentAttestationSourceKind) -> Vec<String> {
    vec![format!("swarm-brief://source/{}", source.as_str())]
}

fn not_collected_entry(
    source: EnvironmentAttestationSourceKind,
    summary: &str,
    inspect_command: &str,
) -> EnvironmentAttestationSourceAuthorityEntry {
    EnvironmentAttestationSourceAuthorityEntry {
        source,
        authority: EnvironmentAttestationAuthority::Unavailable,
        status: EnvironmentAttestationSourceStatus::NotCollected,
        freshness: EnvironmentAttestationFreshness::Unknown,
        observed_at: None,
        summary: summary.to_owned(),
        evidence_refs: Vec::new(),
        metrics: Vec::new(),
        degraded_codes: vec![EnvironmentAttestationDegradedCode::SourceAuthorityAmbiguous],
        recovery_actions: vec![EnvironmentAttestationRecoveryAction {
            priority: 0,
            kind: EnvironmentAttestationRecoveryKind::Inspect,
            command: command_action(inspect_command),
            mutates_state: false,
            required_substrate: EnvironmentAttestationSubstrate::Ee,
            rationale: "Collect source-authority inputs before using the attestation.".to_owned(),
        }],
    }
}

fn insert_degraded_code(
    codes: &mut Vec<EnvironmentAttestationDegradedCode>,
    code: EnvironmentAttestationDegradedCode,
) {
    if !codes.contains(&code) {
        codes.push(code);
    }
}

fn command_action(command: &str) -> Option<EnvironmentAttestationCommandAction> {
    let argv = command
        .split_whitespace()
        .map(ToOwned::to_owned)
        .collect::<Vec<_>>();
    if argv.is_empty() {
        None
    } else {
        Some(EnvironmentAttestationCommandAction {
            display_command: command.to_owned(),
            argv,
            shell_required: false,
            copy_safety: EnvironmentAttestationCommandCopySafety::SafeStructuredArgv,
        })
    }
}

fn metric(name: &str, value: impl ToString) -> EnvironmentAttestationMetric {
    EnvironmentAttestationMetric {
        name: name.to_owned(),
        value: value.to_string(),
    }
}

fn metric_bool(name: &str, value: bool) -> EnvironmentAttestationMetric {
    metric_string(name, value.to_string())
}

fn metric_string(name: &str, value: String) -> EnvironmentAttestationMetric {
    EnvironmentAttestationMetric {
        name: name.to_owned(),
        value,
    }
}

impl EnvironmentAttestationSourceKind {
    #[must_use]
    pub const fn as_str(self) -> &'static str {
        match self {
            Self::InstalledBinary => "installed_binary",
            Self::SourceTree => "source_tree",
            Self::BeadsTracker => "beads_tracker",
            Self::BvRecommendation => "bv_recommendation",
            Self::AgentMailMcp => "agent_mail_mcp",
            Self::AgentMailProbe => "agent_mail_probe",
            Self::Rch => "rch",
            Self::RchSourceMaterialization => "rch_source_materialization",
            Self::BuildAdmission => "build_admission",
            Self::LocalCargoTripwire => "local_cargo_tripwire",
            Self::CiProofLane => "ci_proof_lane",
            Self::HostProfile => "host_profile",
            Self::ClaimGate => "claim_gate",
            Self::FileReservations => "file_reservations",
            Self::SupportBundleRedaction => "support_bundle_redaction",
        }
    }
}

fn attestation_id(attestation: &EnvironmentAttestationReport) -> String {
    #[derive(Serialize)]
    #[serde(rename_all = "camelCase")]
    struct Signature<'a> {
        workspace: &'a str,
        summary: &'a EnvironmentAttestationSummary,
        source_authority: &'a [EnvironmentAttestationSourceAuthorityEntry],
        verdict: EnvironmentAttestationVerdict,
        evidence_refs: &'a [String],
        recovery_actions: &'a [EnvironmentAttestationRecoveryAction],
        degraded: &'a [EnvironmentAttestationDegradation],
    }

    let signature = Signature {
        workspace: &attestation.workspace,
        summary: &attestation.summary,
        source_authority: &attestation.source_authority,
        verdict: attestation.verdict,
        evidence_refs: &attestation.evidence_refs,
        recovery_actions: &attestation.recovery_actions,
        degraded: &attestation.degraded,
    };
    let bytes = serde_json::to_vec(&signature)
        .unwrap_or_else(|_| b"environment_attestation_signature_error".to_vec());
    let hash = blake3::hash(&bytes);
    let hex = hash.to_hex();
    format!("environment_attestation_{}", &hex.as_str()[..24])
}

#[cfg(test)]
mod tests {
    use std::path::Path;

    use chrono::{TimeZone, Utc};
    use serde_json::json;

    use super::*;
    use crate::core::swarm_brief::{
        SwarmBriefBead, SwarmBriefDirtyFile, SwarmBriefFileReservation, SwarmBriefSourceFreshness,
        SwarmBriefSourceProvenance,
    };

    fn fixed_time() -> DateTime<Utc> {
        Utc.with_ymd_and_hms(2026, 6, 4, 20, 0, 0)
            .single()
            .unwrap_or_else(Utc::now)
    }

    fn report_with_sources(sources: Vec<SwarmBriefSourceSnapshot>) -> SwarmBriefReport {
        let mut report = SwarmBriefReport::empty(Path::new("."));
        report.sources = sources;
        report.finalize();
        report
    }

    fn ready_source(source: SwarmBriefSourceKind) -> SwarmBriefSourceSnapshot {
        SwarmBriefSourceSnapshot::ready(source, SwarmBriefSourceProvenance::local_probe(), 1)
    }

    fn degraded_source(
        source: SwarmBriefSourceKind,
        code: &str,
        message: &str,
    ) -> SwarmBriefSourceSnapshot {
        SwarmBriefSourceSnapshot {
            source,
            status: SwarmBriefSourceStatus::Degraded,
            freshness: SwarmBriefSourceFreshness::current(),
            provenance: SwarmBriefSourceProvenance::local_probe(),
            item_count: 0,
            degraded: vec![SwarmBriefDegradation::warning(
                source,
                code,
                message,
                Some("inspect".to_owned()),
            )],
        }
    }

    fn source_kinds(
        report: &EnvironmentAttestationReport,
    ) -> Vec<EnvironmentAttestationSourceKind> {
        report
            .source_authority
            .iter()
            .map(|entry| entry.source)
            .collect()
    }

    fn entry(
        report: &EnvironmentAttestationReport,
        source: EnvironmentAttestationSourceKind,
    ) -> &EnvironmentAttestationSourceAuthorityEntry {
        match report
            .source_authority
            .iter()
            .find(|entry| entry.source == source)
        {
            Some(entry) => entry,
            None => panic!("missing source entry {source:?}"),
        }
    }

    fn ci_proof_lane_fixture(name: &str) -> Value {
        let text = match name {
            "fresh_artifact_available" => {
                include_str!("../../tests/fixtures/ci_proof_lane/fresh_artifact_available.json")
            }
            "artifact_stale" => {
                include_str!("../../tests/fixtures/ci_proof_lane/artifact_stale.json")
            }
            "cancelled_before_artifact" => {
                include_str!("../../tests/fixtures/ci_proof_lane/cancelled_before_artifact.json")
            }
            _ => panic!("unknown CI proof lane fixture {name}"),
        };
        serde_json::from_str(text).unwrap_or_else(|error| panic!("{name} fixture parses: {error}"))
    }

    fn metric_value<'a>(
        entry: &'a EnvironmentAttestationSourceAuthorityEntry,
        name: &str,
    ) -> Option<&'a str> {
        entry
            .metrics
            .iter()
            .find(|metric| metric.name == name)
            .map(|metric| metric.value.as_str())
    }

    #[test]
    fn attestation_orders_sources_and_marks_dirty_checkout_for_coordination() {
        let mut brief = report_with_sources(vec![
            ready_source(SwarmBriefSourceKind::Bv),
            ready_source(SwarmBriefSourceKind::Git),
            ready_source(SwarmBriefSourceKind::Beads),
        ]);
        brief.dirty_files.push(SwarmBriefDirtyFile {
            path: "-".to_owned(),
            status: "??".to_owned(),
        });
        let attestation = environment_attestation_from_swarm_brief(&brief, fixed_time());

        assert_eq!(
            source_kinds(&attestation),
            vec![
                EnvironmentAttestationSourceKind::SourceTree,
                EnvironmentAttestationSourceKind::BeadsTracker,
                EnvironmentAttestationSourceKind::BvRecommendation,
            ]
        );
        let source_tree = entry(&attestation, EnvironmentAttestationSourceKind::SourceTree);
        assert_eq!(
            source_tree.status,
            EnvironmentAttestationSourceStatus::Degraded
        );
        assert!(
            source_tree
                .degraded_codes
                .contains(&EnvironmentAttestationDegradedCode::DirtyCheckoutObserved)
        );
        assert_eq!(
            attestation.verdict,
            EnvironmentAttestationVerdict::CoordinateBeforeClaim
        );
    }

    #[test]
    fn metadata_only_beads_drift_remains_authoritative_with_precise_repair() {
        let brief = report_with_sources(vec![SwarmBriefSourceSnapshot {
            source: SwarmBriefSourceKind::Beads,
            status: SwarmBriefSourceStatus::Ready,
            freshness: SwarmBriefSourceFreshness::current(),
            provenance: SwarmBriefSourceProvenance::command("br", &["sync", "--status", "--json"]),
            item_count: 6,
            degraded: vec![SwarmBriefDegradation::warning(
                SwarmBriefSourceKind::Beads,
                "beads_tracker_metadata_drift",
                "metadata-only drift",
                Some("br sync --import-only --json".to_owned()),
            )],
        }]);
        let attestation = environment_attestation_from_swarm_brief(&brief, fixed_time());
        let beads = entry(&attestation, EnvironmentAttestationSourceKind::BeadsTracker);

        assert_eq!(
            beads.authority,
            EnvironmentAttestationAuthority::Authoritative
        );
        assert_eq!(beads.status, EnvironmentAttestationSourceStatus::Degraded);
        assert_eq!(
            beads.degraded_codes,
            vec![EnvironmentAttestationDegradedCode::BeadsMetadataOnlyStale]
        );
        assert!(attestation.summary.safe_to_claim);
        assert_eq!(
            attestation.verdict,
            EnvironmentAttestationVerdict::SafeToClaim
        );
        assert!(beads.recovery_actions.iter().any(|action| {
            action
                .command
                .as_ref()
                .is_some_and(|command| command.display_command == "br sync --import-only --json")
        }));
    }

    #[test]
    fn rch_topology_blocker_is_environment_blocked_not_source_failure() {
        let brief = report_with_sources(vec![degraded_source(
            SwarmBriefSourceKind::Rch,
            "rch_worker_topology_blocked",
            "RCH-E327 blocked before Cargo",
        )]);
        let attestation = environment_attestation_from_swarm_brief(&brief, fixed_time());
        let rch = entry(&attestation, EnvironmentAttestationSourceKind::Rch);

        assert_eq!(
            rch.status,
            EnvironmentAttestationSourceStatus::RemoteBlocked
        );
        assert_eq!(
            attestation.summary.source_test_verdict,
            EnvironmentAttestationSourceTestVerdict::EnvironmentBlockedBeforeSource
        );
        assert_eq!(
            attestation.verdict,
            EnvironmentAttestationVerdict::ProofEnvironmentBlocked
        );
        assert_eq!(
            attestation.summary.remote_verification_admitted,
            Some(false)
        );
    }

    #[test]
    fn local_cargo_process_scan_detects_bypass_without_mutating_repair_action() {
        let brief = report_with_sources(vec![ready_source(SwarmBriefSourceKind::Git)]);
        let process_scan = json!({
            "schema": "ee.rch_local_cargo_tripwire.v1",
            "mode": "probe_processes",
            "status": "bypass_detected",
            "count": 1,
            "detectedLocalBuilds": [{"kind": "cargo"}],
            "evidence": [{"kind": "active_process_scan", "result": "bypass_detected"}]
        });
        let attestation = environment_attestation_from_swarm_brief_with_inputs(
            &brief,
            EnvironmentAttestationInputs {
                generated_at: fixed_time(),
                local_cargo_process_scan: Some(&process_scan),
                local_cargo_process_scan_origin:
                    EnvironmentAttestationLocalCargoScanOrigin::LiveProbe,
                ci_proof_lane_snapshot: None,
            },
        );
        let tripwire = entry(
            &attestation,
            EnvironmentAttestationSourceKind::LocalCargoTripwire,
        );

        assert_eq!(tripwire.status, EnvironmentAttestationSourceStatus::Blocked);
        assert_eq!(
            attestation.verdict,
            EnvironmentAttestationVerdict::LocalCargoBypassDetected
        );
        assert!(attestation.summary.local_cargo_fallback_observed);
        assert!(
            tripwire
                .recovery_actions
                .iter()
                .all(|action| !action.mutates_state)
        );
    }

    #[test]
    fn fixture_supplied_local_cargo_scan_preserves_input_origin() {
        let brief = report_with_sources(vec![ready_source(SwarmBriefSourceKind::Git)]);
        let process_scan = json!({
            "schema": "ee.rch_local_cargo_tripwire.v1",
            "mode": "probe_processes",
            "status": "bypass_detected",
            "count": 1,
            "detectedLocalBuilds": [{"kind": "cargo"}],
            "evidence": [{"kind": "active_process_scan", "result": "bypass_detected"}]
        });
        let attestation = environment_attestation_from_swarm_brief_with_inputs(
            &brief,
            EnvironmentAttestationInputs {
                generated_at: fixed_time(),
                local_cargo_process_scan: Some(&process_scan),
                local_cargo_process_scan_origin:
                    EnvironmentAttestationLocalCargoScanOrigin::Fixture,
                ci_proof_lane_snapshot: None,
            },
        );
        let tripwire = entry(
            &attestation,
            EnvironmentAttestationSourceKind::LocalCargoTripwire,
        );

        assert_eq!(
            tripwire.evidence_refs,
            vec!["fixture://local-cargo-process-scan"]
        );
        assert_eq!(metric_value(tripwire, "input_origin"), Some("fixture"));
        assert!(tripwire.summary.contains("Fixture-supplied"));
    }

    #[test]
    fn informational_local_cargo_rows_do_not_contradict_attestation() {
        let brief = report_with_sources(vec![ready_source(SwarmBriefSourceKind::Git)]);
        let process_scan = json!({
            "schema": "ee.rch_local_cargo_tripwire.v1",
            "mode": "probe_processes",
            "status": "ok",
            "count": 0,
            "detectedLocalBuilds": [
                {"policyStatus": "editor_tooling_informational"},
                {"policyStatus": "unkillable_stale_informational"}
            ]
        });
        let attestation = environment_attestation_from_swarm_brief_with_inputs(
            &brief,
            EnvironmentAttestationInputs {
                generated_at: fixed_time(),
                local_cargo_process_scan: Some(&process_scan),
                local_cargo_process_scan_origin:
                    EnvironmentAttestationLocalCargoScanOrigin::LiveProbe,
                ci_proof_lane_snapshot: None,
            },
        );
        let tripwire = entry(
            &attestation,
            EnvironmentAttestationSourceKind::LocalCargoTripwire,
        );

        assert_eq!(tripwire.status, EnvironmentAttestationSourceStatus::Ok);
        assert_ne!(
            attestation.verdict,
            EnvironmentAttestationVerdict::LocalCargoBypassDetected
        );
        assert!(!attestation.summary.local_cargo_fallback_observed);
    }

    #[test]
    fn unknown_informational_lookalike_still_contradicts_attestation() {
        let brief = report_with_sources(vec![ready_source(SwarmBriefSourceKind::Git)]);
        let process_scan = json!({
            "schema": "ee.rch_local_cargo_tripwire.v1",
            "mode": "probe_processes",
            "status": "ok",
            "count": 0,
            "detectedLocalBuilds": [{"policyStatus": "unknown_informational"}]
        });
        let attestation = environment_attestation_from_swarm_brief_with_inputs(
            &brief,
            EnvironmentAttestationInputs {
                generated_at: fixed_time(),
                local_cargo_process_scan: Some(&process_scan),
                local_cargo_process_scan_origin:
                    EnvironmentAttestationLocalCargoScanOrigin::LiveProbe,
                ci_proof_lane_snapshot: None,
            },
        );

        assert_eq!(
            attestation.verdict,
            EnvironmentAttestationVerdict::LocalCargoBypassDetected
        );
        assert!(attestation.summary.local_cargo_fallback_observed);
    }

    #[test]
    fn ci_proof_lane_fresh_artifact_is_authoritative_source_evidence() {
        let brief = report_with_sources(vec![ready_source(SwarmBriefSourceKind::Git)]);
        let snapshot = ci_proof_lane_fixture("fresh_artifact_available");
        let attestation = environment_attestation_from_swarm_brief_with_inputs(
            &brief,
            EnvironmentAttestationInputs {
                generated_at: fixed_time(),
                local_cargo_process_scan: None,
                local_cargo_process_scan_origin:
                    EnvironmentAttestationLocalCargoScanOrigin::LiveProbe,
                ci_proof_lane_snapshot: Some(&snapshot),
            },
        );
        let proof_lane = entry(&attestation, EnvironmentAttestationSourceKind::CiProofLane);

        assert_eq!(
            proof_lane.authority,
            EnvironmentAttestationAuthority::Authoritative
        );
        assert_eq!(proof_lane.status, EnvironmentAttestationSourceStatus::Ok);
        assert_eq!(
            proof_lane.freshness,
            EnvironmentAttestationFreshness::Current
        );
        assert!(proof_lane.degraded_codes.is_empty());
        assert_eq!(
            metric_value(proof_lane, "workflow_path"),
            Some(".github/workflows/macos-ee-artifact.yml")
        );
        assert_eq!(
            metric_value(proof_lane, "surface_probe_status"),
            Some("passed")
        );
        assert_eq!(
            metric_value(proof_lane, "artifact_attestation_status"),
            Some("verified")
        );
        assert_eq!(
            attestation.verdict,
            EnvironmentAttestationVerdict::SafeToClaim
        );
    }

    #[test]
    fn ci_proof_lane_fresh_summary_cannot_override_invalid_nested_attestation() {
        for (pointer, replacement) in [
            (
                "/workflows/0/runs/0/artifacts/0/attestationStatus",
                serde_json::json!("not_checked"),
            ),
            (
                "/workflows/0/runs/0/artifacts/0/manifestHash",
                serde_json::json!("sha256:not-a-digest"),
            ),
            (
                "/workflows/0/runs/0/artifacts/0/surfaceProbes/0/status",
                serde_json::json!("not_run"),
            ),
            (
                "/activeRecommendation/runId",
                serde_json::json!("99999999999"),
            ),
            (
                "/workflows/0/runs/0/artifacts/0/attestedRunId",
                serde_json::json!("99999999999"),
            ),
            (
                "/workflows/0/runs/0/artifacts/0/binaryHash",
                serde_json::json!("sha256:not-a-digest"),
            ),
            (
                "/workflows/0/runs/0/artifacts/0/surfaceProbes/1/probeId",
                serde_json::json!("unexpected_probe"),
            ),
        ] {
            let mut snapshot = ci_proof_lane_fixture("fresh_artifact_available");
            *snapshot
                .pointer_mut(pointer)
                .expect("fresh artifact fixture field") = replacement;
            let attestation = environment_attestation_from_swarm_brief_with_inputs(
                &report_with_sources(vec![ready_source(SwarmBriefSourceKind::Git)]),
                EnvironmentAttestationInputs {
                    generated_at: fixed_time(),
                    local_cargo_process_scan: None,
                    local_cargo_process_scan_origin:
                        EnvironmentAttestationLocalCargoScanOrigin::LiveProbe,
                    ci_proof_lane_snapshot: Some(&snapshot),
                },
            );
            let proof_lane = entry(&attestation, EnvironmentAttestationSourceKind::CiProofLane);
            assert_eq!(
                proof_lane.authority,
                EnvironmentAttestationAuthority::Degraded,
                "pointer {pointer}"
            );
            assert_eq!(
                proof_lane.status,
                EnvironmentAttestationSourceStatus::Blocked,
                "pointer {pointer}"
            );
            assert_eq!(
                proof_lane.degraded_codes,
                vec![EnvironmentAttestationDegradedCode::CiProofLaneArtifactAttestationInvalid],
                "pointer {pointer}"
            );
            assert_eq!(
                attestation.verdict,
                EnvironmentAttestationVerdict::SourceAuthorityAmbiguous,
                "pointer {pointer}"
            );
        }
    }

    #[test]
    fn ci_proof_lane_stale_and_cancelled_snapshots_fail_closed() {
        let stale_snapshot = ci_proof_lane_fixture("artifact_stale");
        let stale_attestation = environment_attestation_from_swarm_brief_with_inputs(
            &report_with_sources(vec![ready_source(SwarmBriefSourceKind::Git)]),
            EnvironmentAttestationInputs {
                generated_at: fixed_time(),
                local_cargo_process_scan: None,
                local_cargo_process_scan_origin:
                    EnvironmentAttestationLocalCargoScanOrigin::LiveProbe,
                ci_proof_lane_snapshot: Some(&stale_snapshot),
            },
        );
        let stale_lane = entry(
            &stale_attestation,
            EnvironmentAttestationSourceKind::CiProofLane,
        );

        assert_eq!(stale_lane.status, EnvironmentAttestationSourceStatus::Stale);
        assert_eq!(
            stale_lane.degraded_codes,
            vec![EnvironmentAttestationDegradedCode::CiProofLaneArtifactStale]
        );
        assert_eq!(
            stale_attestation.summary.source_test_verdict,
            EnvironmentAttestationSourceTestVerdict::StaleSource
        );
        assert_eq!(
            stale_attestation.verdict,
            EnvironmentAttestationVerdict::SourceAuthorityAmbiguous
        );
        assert_eq!(
            metric_value(stale_lane, "first_failure_diagnosis"),
            Some("artifact source SHA is older than the requested repository head SHA")
        );

        let cancelled_snapshot = ci_proof_lane_fixture("cancelled_before_artifact");
        let cancelled_attestation = environment_attestation_from_swarm_brief_with_inputs(
            &report_with_sources(vec![ready_source(SwarmBriefSourceKind::Git)]),
            EnvironmentAttestationInputs {
                generated_at: fixed_time(),
                local_cargo_process_scan: None,
                local_cargo_process_scan_origin:
                    EnvironmentAttestationLocalCargoScanOrigin::LiveProbe,
                ci_proof_lane_snapshot: Some(&cancelled_snapshot),
            },
        );
        let cancelled_lane = entry(
            &cancelled_attestation,
            EnvironmentAttestationSourceKind::CiProofLane,
        );

        assert_eq!(
            cancelled_lane.status,
            EnvironmentAttestationSourceStatus::Blocked
        );
        assert_eq!(
            cancelled_lane.degraded_codes,
            vec![EnvironmentAttestationDegradedCode::CiProofLaneCancelledBeforeArtifact]
        );
        assert_eq!(
            cancelled_attestation.summary.source_test_verdict,
            EnvironmentAttestationSourceTestVerdict::NotEvaluated
        );
        assert_eq!(
            cancelled_attestation.verdict,
            EnvironmentAttestationVerdict::SourceAuthorityAmbiguous
        );
    }

    #[test]
    fn ci_proof_lane_safe_text_redacts_support_bundle_path_prefixes() {
        for raw in [
            "artifact extracted under /Volumes/USBNVME16TB/tmp/ee",
            "surface probe wrote to /private/var/folders/ee/stdout.txt",
        ] {
            assert_eq!(
                ci_proof_lane_safe_text(raw).as_deref(),
                Some("redacted_ci_proof_lane_value")
            );
        }
    }

    #[test]
    fn stale_bv_and_agent_mail_sources_normalize_to_schema_codes() {
        let brief = report_with_sources(vec![
            degraded_source(
                SwarmBriefSourceKind::Bv,
                "bv_command_timeout",
                "BV timed out",
            ),
            degraded_source(
                SwarmBriefSourceKind::AgentMail,
                "agent_mail_unavailable",
                "Agent Mail unavailable",
            ),
        ]);
        let attestation = environment_attestation_from_swarm_brief(&brief, fixed_time());
        let bv = entry(
            &attestation,
            EnvironmentAttestationSourceKind::BvRecommendation,
        );
        let mail = entry(
            &attestation,
            EnvironmentAttestationSourceKind::AgentMailProbe,
        );

        assert_eq!(
            bv.degraded_codes,
            vec![EnvironmentAttestationDegradedCode::BvRecommendationStale]
        );
        assert_eq!(
            mail.degraded_codes,
            vec![EnvironmentAttestationDegradedCode::AgentMailUnavailable]
        );
        let mail_action = mail
            .recovery_actions
            .iter()
            .find(|action| action.required_substrate == EnvironmentAttestationSubstrate::AgentMail)
            .and_then(|action| action.command.as_ref())
            .expect("Agent Mail recovery action includes snapshot command");
        assert!(
            mail_action
                .display_command
                .contains("scripts/agent_mail_snapshot.sh")
        );
        assert!(mail_action.display_command.contains("--agent <AGENT_NAME>"));
        assert!(mail_action.display_command.contains("/private/tmp/"));
        assert_eq!(
            attestation.verdict,
            EnvironmentAttestationVerdict::CoordinateBeforeClaim
        );
    }

    #[test]
    fn malformed_and_empty_source_states_fail_closed_as_ambiguous() {
        let empty = SwarmBriefReport::empty(Path::new("."));
        let empty_attestation = environment_attestation_from_swarm_brief(&empty, fixed_time());
        assert_eq!(
            source_kinds(&empty_attestation),
            vec![EnvironmentAttestationSourceKind::ClaimGate]
        );
        assert_eq!(
            empty_attestation.verdict,
            EnvironmentAttestationVerdict::SourceAuthorityAmbiguous
        );

        let malformed = report_with_sources(vec![degraded_source(
            SwarmBriefSourceKind::AgentMail,
            "agent_mail_snapshot_malformed",
            "malformed redacted snapshot",
        )]);
        let malformed_attestation =
            environment_attestation_from_swarm_brief(&malformed, fixed_time());
        let mail = entry(
            &malformed_attestation,
            EnvironmentAttestationSourceKind::AgentMailProbe,
        );
        assert_eq!(
            mail.degraded_codes,
            vec![EnvironmentAttestationDegradedCode::SourceAuthorityAmbiguous]
        );
        assert_eq!(
            malformed_attestation.verdict,
            EnvironmentAttestationVerdict::SourceAuthorityAmbiguous
        );
    }

    #[test]
    fn file_reservation_entry_blocks_conflicting_claims_deterministically() {
        let mut brief = report_with_sources(vec![ready_source(SwarmBriefSourceKind::AgentMail)]);
        brief.file_reservations.push(SwarmBriefFileReservation {
            path_pattern: "src/core/*.rs".to_owned(),
            holder: "RedactedAgent".to_owned(),
            exclusive: true,
            expires_at: Some("2026-06-04T22:00:00Z".to_owned()),
        });
        brief.beads.ready.push(SwarmBriefBead {
            id: "bd-example".to_owned(),
            title: "example".to_owned(),
            status: "open".to_owned(),
            priority: Some(1),
            assignee: None,
            issue_type: Some("task".to_owned()),
            created_at: None,
            updated_at: None,
            latest_comment_at: None,
            comment_count: 0,
            source_bucket: "ready".to_owned(),
        });
        let attestation = environment_attestation_from_swarm_brief(&brief, fixed_time());
        let reservations = entry(
            &attestation,
            EnvironmentAttestationSourceKind::FileReservations,
        );

        assert_eq!(
            reservations.degraded_codes,
            vec![EnvironmentAttestationDegradedCode::ReservationEvidenceStale]
        );
        assert_eq!(
            attestation.verdict,
            EnvironmentAttestationVerdict::UnsafeDueToConflict
        );
    }
}