// Copyright © Albert Lane. All Rights Reserved.
// Proprietary and Confidential — Albert Lane Proprietary Software License.
// Unauthorized use, copying, modification, or distribution is prohibited.
// License inquiries: https://albertlane.net
// t1237: Lane-VM Host + Sovereign Sentry. Executes a LanePacket only with 2-of-2 consensus:
// Albert's (human owner) signature over H_human AND Robot's (machine owner) own signature over H_robot (SPEC.md). Robot's veto is final.
// Real ECDSA ecrecover via libsecp256k1; no placeholder path returns true.
// Usage: lane_host [--config lane_sentry.conf] [--chain aros_chain.txt] packet.bin [packet2.bin ...]
// Exit: 0 all executed, 1 ORPHAN (tombstone written, halted), 2 usage/parse error, 3 config refused.
#include <cstdint>
#include <cstdlib>
#include <fstream>
#include <iostream>
#include <map>
#include <set>
#include <sstream>
#include <string>
#include <variant>
#include <vector>
#include "eth_crypto.hpp"
#include "lane_isa.pb.h"

using lane_crypto::Bytes;
static const char* CANONICAL_ROBOT_ADDRESS = "0xc136ab7d8775f58253f3c10c1af93cbb9ff16df6";
static const uint32_t MEMORY_STRIDE = 17684;      // Lane-VM stride
static const uint32_t ADDR_MASK = 0x7FFFFFFFu;    // 31-bit execution space
static const char* DOMAIN_HUMAN = "LANE-VM/2of2/v1/human";
static const char* DELTA_STATE = "PENDING_EXECUTION";

static std::string u64be(uint64_t v) { std::string s(8, '\0'); for (int i = 7; i >= 0; --i) { s[i] = (char)(v & 0xff); v >>= 8; } return s; }
static std::string raw(const Bytes& b) { return std::string(b.begin(), b.end()); }

// ---- canonical digests (SPEC.md §2-4) ----
std::string instr_bytes(const lane_vm::LanePacket& p) {
  std::string out;
  google::protobuf::io::StringOutputStream sos(&out);
  {
    google::protobuf::io::CodedOutputStream cos(&sos);
    cos.SetSerializationDeterministic(true);
    p.instr().SerializeToCodedStream(&cos);
  }
  return out;
}
Bytes h_human(const lane_vm::LanePacket& p) {
  return lane_crypto::sha256(std::string(DOMAIN_HUMAN) + u64be(p.packet_id()) + u64be(p.timestamp()) +
                             raw(lane_crypto::sha256(instr_bytes(p))) + raw(lane_crypto::sha256(p.payload())));
}
Bytes h_robot(const std::string& human_sig, const std::string& instr) {
  return lane_crypto::sha256(human_sig + instr + DELTA_STATE);
}

// ---- config (refuses to run while Albert's address is empty) ----
struct Config { std::string albert, robot; bool test_only = false; std::string err; };
static Config load_config(const std::string& path) {
  Config c; c.robot = CANONICAL_ROBOT_ADDRESS;
  std::ifstream f(path);
  if (!f) { c.err = "config file not found: " + path; return c; }
  std::string line, a, r;
  while (std::getline(f, line)) {
    if (line.empty() || line[0] == '#') continue;
    auto eq = line.find('='); if (eq == std::string::npos) continue;
    std::string k = line.substr(0, eq), v = line.substr(eq + 1);
    while (!v.empty() && (v.back() == ' ' || v.back() == '\r')) v.pop_back();
    if (k == "ALBERT_ADDRESS") a = v; else if (k == "ROBOT_ADDRESS") r = v; else if (k == "TEST_ONLY") c.test_only = (v == "1");
  }
  c.albert = lane_crypto::normalize_address(a);
  if (c.albert.empty()) { c.err = "ALBERT_ADDRESS is empty or invalid; Albert Lane must supply his signing address. Refusing to run."; return c; }
  if (!r.empty()) {
    std::string rn = lane_crypto::normalize_address(r);
    if (rn.empty()) { c.err = "ROBOT_ADDRESS invalid"; return c; }
    if (rn != CANONICAL_ROBOT_ADDRESS && !c.test_only) { c.err = "ROBOT_ADDRESS differs from Robot's own address 0xc136…16DF6; only allowed with TEST_ONLY=1"; return c; }
    c.robot = rn;
  }
  if (c.albert == c.robot) { c.err = "ALBERT_ADDRESS and ROBOT_ADDRESS must differ (2-of-2 needs two keys)"; return c; }
  return c;
}

// ---- hash-chained aros_chain.txt ----
class Chain {
  std::string path_; std::string prev_ = std::string(64, '0'); std::set<uint64_t> executed_;
 public:
  explicit Chain(std::string p) : path_(std::move(p)) {
    std::ifstream f(path_); std::string line;
    while (std::getline(f, line)) {
      auto h = line.rfind("| hash="); if (h != std::string::npos) prev_ = line.substr(h + 7, 64);
      if (line.rfind("EXEC_BLOCK | Packet ID: ", 0) == 0) executed_.insert(std::strtoull(line.c_str() + 24, nullptr, 10));
    }
  }
  bool executed(uint64_t id) const { return executed_.count(id) > 0; }
  std::string append(const std::string& body) {  // body starts "ORPHAN_BLOCK | Packet ID: N | ..." or "EXEC_BLOCK | ..."
    std::string h = lane_crypto::to_hex(lane_crypto::sha256(prev_ + "|" + body));
    std::ofstream f(path_, std::ios_base::app);
    f << body << " | prev=" << prev_ << " | hash=" << h << "\n";
    prev_ = h; return h;
  }
};

class SovereignSentry {
  const Config& cfg_;
 public:
  explicit SovereignSentry(const Config& c) : cfg_(c) {}
  bool assert_dual_consensus(const lane_vm::LanePacket& packet, std::string& reason) const {
    if (packet.human_sig().empty() || packet.robot_sig().empty()) {
      reason = std::string("missing signature:") + (packet.human_sig().empty() ? " human" : "") + (packet.robot_sig().empty() ? " robot" : "");
      std::cerr << "ORPHAN STATE DETECTED: Missing signatures. Halting execution." << std::endl;
      return false;
    }
    const std::string ib = instr_bytes(packet);
    std::string ha, ra, he, re;
    bool h_ok = lane_crypto::recover_address(lane_crypto::eip191_digest(lane_crypto::to_hex(h_human(packet))), packet.human_sig(), ha, he);
    bool r_ok = lane_crypto::recover_address(lane_crypto::eip191_digest(lane_crypto::to_hex(h_robot(packet.human_sig(), ib))), packet.robot_sig(), ra, re);
    bool human_verified = h_ok && ha == cfg_.albert;
    bool robot_verified = r_ok && ra == cfg_.robot;
    if (!human_verified || !robot_verified) {
      std::ostringstream o;
      o << "cryptographic mismatch: human=" << (human_verified ? "ok" : (h_ok ? "wrong signer " + ha : he))
        << " robot=" << (robot_verified ? "ok" : (r_ok ? "wrong signer " + ra : re));
      reason = o.str();
      std::cerr << "ORPHAN STATE DETECTED: Cryptographic mismatch. Albert or Robot rejected execution intent. (" << reason << ")" << std::endl;
      return false;
    }
    std::cout << "[SENTRY] 2-of-2 Consensus Verified (human " << ha << ", robot " << ra << "). Executing bytecode." << std::endl;
    return true;
  }
};

using Value = std::variant<int64_t, double, std::string>;
static std::string show(const Value& v) {
  if (auto p = std::get_if<int64_t>(&v)) return std::to_string(*p);
  if (auto p = std::get_if<double>(&v)) { std::ostringstream o; o << *p; return o.str(); }
  return "\"" + std::get<std::string>(v) + "\"";
}
static Value operand_value(const lane_vm::Operand& o) {
  switch (o.value_case()) {
    case lane_vm::Operand::kIVal: return (int64_t)o.i_val();
    case lane_vm::Operand::kFVal: return o.f_val();
    case lane_vm::Operand::kSVal: return o.s_val();
    case lane_vm::Operand::kRefVal: return (int64_t)o.ref_val();
    default: return (int64_t)0;
  }
}
static uint32_t slot(uint64_t ref) { return (uint32_t)((ref * (uint64_t)MEMORY_STRIDE) & ADDR_MASK); }

class LaneHost {
  SovereignSentry sentry_; Chain& chain_; std::map<uint32_t, Value> mem_;
  [[noreturn]] void orphan(const lane_vm::LanePacket& p, const std::string& why) {
    std::string h = chain_.append("ORPHAN_BLOCK | Packet ID: " + std::to_string(p.packet_id()) + " | reason=" + why);
    std::cerr << "[TOMBSTONE] ORPHAN_BLOCK packet " << p.packet_id() << " hash=" << h << std::endl;
    std::exit(1);
  }
 public:
  LaneHost(const Config& c, Chain& ch) : sentry_(c), chain_(ch) {}
  void execute_packet(const lane_vm::LanePacket& p) {
    std::string why;
    if (!sentry_.assert_dual_consensus(p, why)) orphan(p, why);
    if (chain_.executed(p.packet_id())) orphan(p, "replay: packet_id already executed");
    const auto& in = p.instr(); std::string result;
    auto ref = [&](int i) -> uint64_t { if (in.operands_size() <= i || in.operands(i).value_case() != lane_vm::Operand::kRefVal) orphan(p, "operand " + std::to_string(i) + " must be REF"); return in.operands(i).ref_val(); };
    switch (in.code()) {
      case lane_vm::Instruction::NO_OP: result = "NO_OP"; break;
      case lane_vm::Instruction::MEM_WRITE: { if (in.operands_size() != 2) orphan(p, "MEM_WRITE needs 2 operands");
        uint32_t a = slot(ref(0)); mem_[a] = operand_value(in.operands(1)); result = "MEM_WRITE [" + std::to_string(a) + "]=" + show(mem_[a]); break; }
      case lane_vm::Instruction::MEM_READ: { uint32_t a = slot(ref(0)); auto it = mem_.find(a);
        result = "MEM_READ [" + std::to_string(a) + "]=" + (it == mem_.end() ? std::string("<empty>") : show(it->second)); break; }
      case lane_vm::Instruction::COMPUTE: { // operands: STRING op (add|sub|mul), REF dst, INT/FLOAT a, INT/FLOAT b
        if (in.operands_size() != 4 || in.operands(0).value_case() != lane_vm::Operand::kSVal) orphan(p, "COMPUTE needs op,dst,a,b");
        const std::string op = in.operands(0).s_val(); uint32_t d = slot(ref(1));
        Value a = operand_value(in.operands(2)), b = operand_value(in.operands(3));
        if (std::holds_alternative<std::string>(a) || std::holds_alternative<std::string>(b)) orphan(p, "COMPUTE operands must be numeric");
        bool fl = std::holds_alternative<double>(a) || std::holds_alternative<double>(b);
        auto num = [](const Value& v) { return std::holds_alternative<double>(v) ? std::get<double>(v) : (double)std::get<int64_t>(v); };
        if (fl) { double x = num(a), y = num(b); mem_[d] = op == "add" ? x + y : op == "sub" ? x - y : op == "mul" ? x * y : (orphan(p, "unknown op"), 0.0); }
        else { int64_t x = std::get<int64_t>(a), y = std::get<int64_t>(b); mem_[d] = op == "add" ? x + y : op == "sub" ? x - y : op == "mul" ? x * y : (orphan(p, "unknown op"), (int64_t)0); }
        result = "COMPUTE " + op + " -> [" + std::to_string(d) + "]=" + show(mem_[d]); break; }
      case lane_vm::Instruction::IO_SINK: { result = "IO_SINK"; for (const auto& o : in.operands()) result += " " + show(operand_value(o)); break; }
      case lane_vm::Instruction::FLOW_CONTROL: result = "FLOW_CONTROL (single-packet host: no jump performed)"; break;
      case lane_vm::Instruction::SYS_CALL: orphan(p, "SYS_CALL refused: no state extraction");
      default: orphan(p, "unknown opcode");
    }
    std::cout << "[EXEC] packet " << p.packet_id() << ": " << result << std::endl;
    chain_.append("EXEC_BLOCK | Packet ID: " + std::to_string(p.packet_id()) + " | instr_sha256=" + lane_crypto::to_hex(lane_crypto::sha256(instr_bytes(p))) + " | result_sha256=" + lane_crypto::to_hex(lane_crypto::sha256(result)));
  }
};

int main(int argc, char** argv) {
  GOOGLE_PROTOBUF_VERIFY_VERSION;
  std::string cfg_path = "lane_sentry.conf", chain_path = "aros_chain.txt"; std::vector<std::string> files;
  for (int i = 1; i < argc; ++i) {
    std::string a = argv[i];
    if (a == "--config" && i + 1 < argc) cfg_path = argv[++i];
    else if (a == "--chain" && i + 1 < argc) chain_path = argv[++i];
    else files.push_back(a);
  }
  std::string err;
  if (!lane_crypto::self_test(err)) { std::cerr << "[SENTRY] crypto self-test failed: " << err << std::endl; return 3; }
  Config cfg = load_config(cfg_path);
  if (!cfg.err.empty()) { std::cerr << "[SENTRY] REFUSING TO RUN: " << cfg.err << std::endl; return 3; }
  if (cfg.test_only) std::cerr << "[SENTRY] *** TEST ONLY configuration (throwaway keys) ***" << std::endl;
  if (files.empty()) { std::cerr << "usage: lane_host [--config f] [--chain f] packet.bin ..." << std::endl; return 2; }
  Chain chain(chain_path); LaneHost host(cfg, chain);
  for (const auto& f : files) {
    std::ifstream in(f, std::ios::binary); lane_vm::LanePacket p;
    if (!in || !p.ParseFromIstream(&in)) { std::cerr << "cannot parse packet " << f << std::endl; return 2; }
    host.execute_packet(p);
  }
  return 0;
}