from __future__ import annotations

import json
from pathlib import Path

ROOT=Path(__file__).resolve().parents[1]


def test_executor_has_single_model_governance_sqlite_write_path():
    unit=(ROOT/"deploy/systemd/aios-external-agent-executor.service").read_text()
    assert "AIOS_MODEL_GOVERNANCE_DB=/var/lib/aios-model-governance/state.sqlite3" in unit
    assert "AIOS_MODEL_GOVERNANCE_ENABLED=1" in unit
    assert "ReadWritePaths=/var/lib/aios-model-governance" in unit
    assert "ReadWritePaths=/var/lib/aios-external-agent-executor" in unit
    assert "InaccessiblePaths=/etc/aios-gitops" in unit
    assert "InaccessiblePaths=/data/aios-gitops" in unit


def test_tmpfiles_owner_matches_external_executor():
    line=(ROOT/"deploy/tmpfiles.d/aios-model-governance.conf").read_text().strip()
    assert line == (
        "d /var/lib/aios-model-governance 0750 "
        "aios-engineering-executor aios-executor-exchange -"
    )


def test_staging_models_use_real_e2e_evaluation_evidence():
    value=json.loads(
        (ROOT/"config/model-governance/model-governance.staging.json").read_text()
    )
    assert value["schema"]=="aios.model-governance.bootstrap.v1"
    models={item["model_id"]:item for item in value["models"]}
    assert models["deepseek-v4-flash"]["evaluation_sha256"] == (
        "43ae0db1640daeb6d33e2787769732844f366d36070065d3a2239905bd9a823b"
    )
    assert models["openai/deepseek-v4-flash"]["evaluation_sha256"] == (
        "7b1c89634eb9c0e7cb5a3d75323d904ebbd91b3ae5494ce938bd8316a4cf5b12"
    )


def test_runtime_profiles_bind_model_from_governance_not_task():
    for name in ("hermes","openclaw"):
        value=json.loads(
            (ROOT/"config/external-agent-runtime.d"/f"{name}.profile.json").read_text()
        )
        governance=value["model_governance"]
        assert governance["required"] is True
        assert governance["provider_ids"]
        assert governance["max_output_tokens"] > 0
        serialized=json.dumps(value["argv"])+json.dumps(value.get("environment",{}))
        assert "{model_id}" in serialized or "{provider_id}" in serialized


def test_staging_bootstrap_has_explicit_tenant_live_policy():
    value=json.loads(
        (ROOT/"config/model-governance/model-governance.staging.json").read_text()
    )
    keys={
        (
            item["scope_type"],
            item.get("tenant_id"),
            item.get("project_id"),
        )
        for item in value["policies"]
    }
    assert ("legacy",None,None) in keys
    assert ("tenant","model-governance-live","staging") in keys


def test_staging_policy_input_limit_covers_root_owned_openclaw_reservation_floor():
    config=json.loads(
        (ROOT/"config/model-governance/model-governance.staging.json").read_text()
    )
    profile=json.loads(
        (ROOT/"config/external-agent-runtime.d/openclaw.profile.json").read_text()
    )
    floor=int(profile["model_governance"]["input_reservation_floor_tokens"])
    assert floor==16384
    openclaw_model="openai/deepseek-v4-flash"
    relevant=[
        policy for policy in config["policies"]
        if openclaw_model in policy["allowed_models"]
    ]
    assert relevant
    for policy in relevant:
        assert int(policy["max_input_tokens_per_request"]) >= floor


def test_staging_openclaw_scope_limit_is_least_privilege_floor_not_model_ceiling():
    config=json.loads(
        (ROOT/"config/model-governance/model-governance.staging.json").read_text()
    )
    models={item["model_id"]:item for item in config["models"]}
    model=models["openai/deepseek-v4-flash"]
    assert int(model["max_input_tokens"])==32768
    for policy in config["policies"]:
        if "openai/deepseek-v4-flash" in policy["allowed_models"]:
            assert int(policy["max_input_tokens_per_request"])==16384
            assert int(policy["max_input_tokens_per_request"]) < int(model["max_input_tokens"])