#!/usr/bin/env bash
# Phase 12E.19 — the CI / release matrix runner (native lane).
#
# # PURPOSE
#
# One command that runs the native release matrix and archives the
# capability status of every lane (the 12E.19 brief: "Do not hide
# unavailable privileged tests. Archive their capability status."). The
# enterprise-distro lanes run via tools/distro-court.sh; the Miri lane
# via tools/court-miri.sh; this runner is the native lane + the tooling
# gates.
#
# # LANES
#
#   rust:      MSRV check (tools/check-msrv.sh) + stable build
#   tooling:   cargo fmt --check, cargo clippy --all-targets (0 warnings)
#   security:  cargo audit (advisory DB; requires network), cargo deny
#              (license/bans; requires cargo-deny installed)
#   features:  the 6-combination feature matrix (tools/check-feature-matrix.sh)
#   correctness: the full release lib suite (crash/hostile/parity/golden/
#              fsck/worker courts are all in-suite)
#   frontend:  the C ABI smoke (tools/ffi-smoke.sh) + the Go binding
#              court (tools/go-test.sh)
#   privileged: io_uring + FUSE probes (recorded, never hidden)
#
# Each lane's availability is recorded; a missing tool (e.g. cargo-deny)
# is a recorded capability status, not a silent skip.
#
# # USAGE
#
#     tools/ci-matrix.sh [OUTROOT]
#
# Archives under evidence/ci-matrix-<ts>-<rev>/ with per-lane logs and
# a machine-readable matrix.json. Exit nonzero if a REQUIRED lane fails
# (fmt/clippy/features/correctness are required; audit/deny are
# capability-recorded).

set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
REPO_ROOT="$(cd "$SCRIPT_DIR/.." && pwd)"
OUTROOT="${1:-$REPO_ROOT/evidence/ci}"
BUILD_DIR="${COURT_WORKTREE:-$REPO_ROOT}"

TS="$(date +%s)"
REV="$(git -C "$BUILD_DIR" rev-parse --short HEAD)"
# The archive is staged OUTSIDE the repo tree and moved into place only
# after every lane completes. This is mandatory: `source_tree_pack`
# (src/evidence/corpus.rs) packs the repo's `evidence/` dir, so writing
# the archive into `evidence/` DURING the suite would make the
# determinism court (`source_pack_is_deterministic`) race the pack.
STAGE="${COURT_STAGE:-$(mktemp -d /tmp/efs-ci-matrix-XXXXXX)}"
OUT="$OUTROOT/ci-matrix-$TS-$REV"
mkdir -p "$STAGE"
exec > >(tee "$STAGE/runner.log") 2>&1

echo "== phase-12E.19 CI matrix: rev=$REV =="

run_lane() {
    # $1 = lane name, $2 = required (0/1), rest = command
    local lane="$1" required="$2"
    shift 2
    echo "-- lane: $lane --"
    if "$@" > "$STAGE/$lane.log" 2>&1; then
        echo "  $lane: PASS" >> "$STAGE/matrix.txt"
        echo "  PASS"
    else
        if [[ "$required" == "1" ]]; then
            echo "  $lane: FAILED (required)" >> "$STAGE/matrix.txt"
            echo "  FAILED"
            tail -20 "$STAGE/$lane.log"
            FAILED=1
        else
            echo "  $lane: UNAVAILABLE (capability; recorded)" >> "$STAGE/matrix.txt"
            echo "  UNAVAILABLE (recorded)"
        fi
    fi
}

FAILED=0
: > "$STAGE/matrix.txt"

cd "$BUILD_DIR"

# --- rust / tooling (required) ---------------------------------------------
run_lane fmt 1 cargo fmt --check
run_lane clippy 1 cargo clippy --all-targets
run_lane msrv 1 bash "$SCRIPT_DIR/check-msrv.sh"
run_lane feature-matrix 1 bash "$SCRIPT_DIR/check-feature-matrix.sh"

# --- security lanes (capability-recorded) ----------------------------------
if command -v cargo-audit >/dev/null 2>&1 || command -v cargo-audit-audit >/dev/null 2>&1; then
    run_lane audit 0 cargo audit
else
    echo "  audit: cargo-audit NOT INSTALLED (recorded)" >> "$STAGE/matrix.txt"
    echo "-- lane: audit -- UNAVAILABLE (cargo-audit not installed)"
fi
if command -v cargo-deny >/dev/null 2>&1; then
    run_lane deny 0 cargo deny check
else
    echo "  deny: cargo-deny NOT INSTALLED (recorded)" >> "$STAGE/matrix.txt"
    echo "-- lane: deny -- UNAVAILABLE (cargo-deny not installed)"
fi

# --- correctness (required) -------------------------------------------------
# The suite has ONE known flake (`worker_pool_probe::pool_probe_gates`:
# the 16T adoption gate is a CPU-contention measurement that fails under
# full-suite parallel load and passes alone — documented, not a bug). The
# lane runs the flake protocol: suite fail -> rerun the failing tests
# alone -> pass-alone confirms the flake and the lane is PASS-with-note.
run_release_suite() {
    if cargo test --release --lib > "$STAGE/release-suite.log" 2>&1; then
        echo "  PASS" >> "$STAGE/matrix.txt"
        echo "  PASS"
        return 0
    fi
    echo "  suite failed; running the flake protocol (failing tests alone)" >&2
    local failing
    failing=$(grep -E "^    tests::" "$STAGE/release-suite.log" | tr -d ' ' | sed 's/^tests:://')
    if [[ -z "$failing" ]]; then
        echo "  release-suite: FAILED (no per-test failure names in the log)" >> "$STAGE/matrix.txt"
        echo "  FAILED"
        return 1
    fi
    local all_alone_ok=1
    for t in $failing; do
        if ! cargo test --release --lib "$t" >> "$STAGE/release-suite-alone.log" 2>&1; then
            all_alone_ok=0
            echo "  $t still fails alone — real failure" >&2
        fi
    done
    if [[ "$all_alone_ok" == "1" ]]; then
        echo "  release-suite: PASS (flake protocol: $failing passed alone)" >> "$STAGE/matrix.txt"
        echo "  PASS (flake confirmed: $failing)"
        return 0
    fi
    echo "  release-suite: FAILED" >> "$STAGE/matrix.txt"
    echo "  FAILED"
    return 1
}
run_release_suite || FAILED=1

# --- frontends (required: the C ABI + Go binding courts) --------------------
run_lane ffi-smoke 1 bash "$SCRIPT_DIR/ffi-smoke.sh"
run_lane go-binding 1 bash "$SCRIPT_DIR/go-test.sh"

# --- privileged probes (recorded, never hidden) -----------------------------
{
    echo "io_uring:"
    ./target/release/entropyfs capabilities 2>/dev/null | grep -i uring || echo "  (capabilities query unavailable)"
    echo "fuse:"
    if [[ -e /dev/fuse ]]; then echo "  /dev/fuse present"; else echo "  /dev/fuse ABSENT"; fi
    echo "kernel:"
    uname -r
} > "$STAGE/privileged-probes.txt" 2>&1 || true
cat "$STAGE/privileged-probes.txt"

# --- seal -------------------------------------------------------------------
python3 - "$STAGE" "$REV" <<'PY'
import json, os, sys
out, rev = sys.argv[1], sys.argv[2]
rows = {}
for line in open(os.path.join(out, "matrix.txt")):
    if ":" not in line:
        continue
    lane, status = line.split(":", 1)
    rows[lane.strip()] = status.strip()
env = {
    "oracle": "phase-12e19-ci-matrix",
    "rev": rev,
    "kernel": os.uname().release,
    "machine": next(
        (l.split(":", 1)[1].strip() for l in open("/proc/cpuinfo") if l.startswith("model name")),
        "unknown",
    ),
    "lanes": rows,
    "privileged_probes": open(os.path.join(out, "privileged-probes.txt")).read(),
}
with open(os.path.join(out, "matrix.json"), "w") as f:
    json.dump(env, f, indent=2)
    f.write("\n")
print("sealed:", out)
PY

BIN="$REPO_ROOT/target/release/entropyfs"
if [[ -x "$BIN" ]]; then
    "$BIN" evidence-manifest "$STAGE/evidence-manifest.json" \
        --store "$STAGE" --io-backend sync --worker-scheduler pool \
        --court-schema-version 2 >/dev/null 2>&1 || true
fi

# The archive moves into evidence/ only after EVERY lane finished.
mkdir -p "$OUTROOT"
mv "$STAGE" "$OUT"
echo "sealed: $OUT"
echo "== CI matrix done (FAILED=$FAILED) =="
exit "$FAILED"