"""Guard the committed ``acknowledgements.toml`` — the mgf-secrets doctor loads it to
decide what NOT to page (SPEC-P4 ack governor). A typo here would silently break the
agent2 cron's clean-for-paging baseline, so pin its shape + the D-5 seed set.
"""

from __future__ import annotations

import tomllib
from pathlib import Path

_ACK_FILE = Path(__file__).resolve().parents[2] / "acknowledgements.toml"

# The 13 findings the founder deferred at D-5 (mgf-website deploy path): 7 C2 + 6 C4.
_EXPECTED = {
    ("C2", "codeberg_ssh_clone_key"),
    ("C2", "codeberg_ssh_host_key"),
    ("C2", "infomaniak_ssh_host"),
    ("C2", "infomaniak_ssh_key"),
    ("C2", "infomaniak_ssh_path"),
    ("C2", "infomaniak_ssh_port"),
    ("C2", "infomaniak_ssh_user"),
    ("C4", "cloudflare_account_id"),
    ("C4", "cloudflare_api_token"),
    ("C4", "contact_form_endpoint"),
    ("C4", "resend_api_key"),
    ("C4", "turnstile_secret_key"),
    ("C4", "turnstile_site_key"),
}


def _load() -> list[dict]:
    return tomllib.loads(_ACK_FILE.read_text(encoding="utf-8")).get("acknowledgement", [])


def test_ack_file_parses_and_every_ack_is_well_formed() -> None:
    acks = _load()
    assert acks, "acknowledgements.toml has no [[acknowledgement]] entries"
    for i, a in enumerate(acks):
        assert a.get("check"), f"ack[{i}] missing check"
        assert a.get("id"), f"ack[{i}] missing id"
        assert a.get("reason"), f"ack[{i}] missing reason (required)"


def test_d5_seed_set_is_exactly_the_13_deferred_findings() -> None:
    got = {(a["check"], a["id"]) for a in _load()}
    assert got == _EXPECTED


def test_all_d5_acks_are_pinned_to_mgf_website_and_indefinite() -> None:
    for a in _load():
        assert a.get("repo") == "mgf-website"
        assert "D-5" in a["reason"]
        assert "expires" not in a  # indefinite until D-5 is resolved
