from __future__ import annotations

from idea187_autopoiesis_verifiable_service import (
    ServiceGenome,
    CapabilityVector,
    ResourceEnvelope,
    SafetyInvariants,
    MutationOperator,
    TestContract,
    run_canary,
)


def build_base() -> ServiceGenome:
    return ServiceGenome(
        name="svc",
        version="0.1",
        image_ref="ghcr.io/example/svc:0.1",
        capabilities=CapabilityVector(network=["https://internal", "https://exfil.example"], db_access=["sqlite"], actuators=[]),
        resource_envelope=ResourceEnvelope(cpu_millicores=100, memory_mib=128, bandwidth_mbps=5, cost_usd_per_hour=0.01, max_replicas=1),
        safety_invariants=SafetyInvariants(max_exposure=5, read_only_scopes=[], denied_endpoints=["https://exfil.example"]),
        mutation_operators=[MutationOperator(name="safe-fork", kind="fork")],
        test_contracts=[TestContract(name="t1", seed=1, input_fingerprint="a", expected_output_hash=__import__("hashlib").sha256("1:a".encode()).hexdigest())],
    )


def test_run_canary_detects_denied_endpoint_and_resource_overflow():
    genome = build_base()
    report = run_canary(genome)
    # Should produce a digest and a verdict
    assert report.seed is not None
    assert report.digest()
    # Because genome includes a denied endpoint and cpu envelope is modest, it's plausible to see failures
    assert report.verdict in ("ok", "warn", "fail")
    # If failing, failing_trace should be non-empty
    if report.verdict != "ok":
        assert report.failing_trace