#!/usr/bin/env python3
"""Independently replay Avarent's synthetic descriptive record; Python standard library.
Not a vendor-model reproduction, cryptographic attestation or legal validation.
Usage: python3 verify_review.py avarent-review-v2.json
"""
import json, math, sys, datetime

def require(ok, message):
    if not ok:
        raise ValueError(message)

def close(a, b, message):
    if a is None or b is None:
        require(a is None and b is None, message)
    else:
        require(math.isclose(a, b, rel_tol=1e-10, abs_tol=1e-10), message)

def count(rows, group):
    members = [r for r in rows if r['cohort'] == group]
    n = len(members)
    successes = sum(r['decision'] == 'Approved' for r in members)
    p = successes / n if n else None
    interval = None
    if n:
        z = 1.96
        denominator = 1 + z*z/n
        midpoint = (p + z*z/(2*n))/denominator
        radius = z * math.sqrt((p*(1-p) + z*z/(4*n))/n) / denominator
        interval = [max(0, midpoint-radius), min(1, midpoint+radius)]
    return dict(cohort=group, n=n, approved=successes, rate=p, interval=interval)

def replay(rows, config):
    source = [r for r in rows if
        (config['channel'] == 'All' or r['channel'] == config['channel']) and
        (config['version'] == 'All' or r['version'] == config['version']) and
        config['from'] <= r['timestamp'][:10] <= config['to']]
    seen, included, excluded = set(), [], []
    for r in sorted(source, key=lambda x: (x['timestamp'].encode('utf-16-be'), x['id'].encode('utf-16-be'))):
        reason = None
        if r['decision'] not in ('Approved', 'Denied'):
            reason = 'Non-final outcome'
        elif r['applicantId'] in seen:
            reason = 'Later final application from same applicant'
        else:
            seen.add(r['applicantId'])
            if r['cohort'] is None:
                reason = 'Missing supplied proxy'
        if reason:
            excluded.append(dict(id=r['id'], reason=reason))
        else:
            included.append(r)
    groups = ['Cohort A' if config['reference'] == 'Cohort B' else 'Cohort B', config['reference']]
    raw = [count(included, g) for g in groups]
    qualified, sparse = [], []
    for band in sorted(set(r['riskBand'] for r in included), key=lambda s:s.encode('utf-16-be')):
        members = [r for r in included if r['riskBand'] == band]
        group_counts = [count(members, g) for g in groups]
        item = dict(band=band, rates=group_counts, ids=[r['id'] for r in members])
        (qualified if all(g['n'] >= config['minimum'] for g in group_counts) else sparse).append(item)
    weight_total = sum(sum(g['n'] for g in s['rates']) for s in qualified)
    standardized = [sum((s['rates'][0]['n'] + s['rates'][1]['n']) * s['rates'][i]['rate'] / weight_total for s in qualified) if weight_total else None for i in range(2)]
    rates = standardized if config['stratify'] else [g['rate'] for g in raw]
    ratio = rates[0]/rates[1] if all(v is not None for v in rates) and rates[1] > 0 else None
    difference = rates[0]-rates[1] if all(v is not None for v in rates) else None
    missing = sum(r['cohort'] is None for r in source)
    coverage = 1-missing/len(source) if source else 0
    withheld = not source or any(g['n'] < config['minimum'] for g in raw) or (config['stratify'] and not qualified) or (config['population'] == 'all-applications' and 1-coverage > config['maxMissing'])
    state = 'Interpretation withheld' if withheld or ratio is None else 'Triggered configured screening rule' if ratio < config['threshold'] else 'No screen trigger'
    version_profile=[dict(version=v,sourceCount=sum(r['version']==v for r in source),eligibleCount=sum(r['version']==v for r in included),raw=[count([r for r in included if r['version']==v],g) for g in groups]) for v in sorted(set(r['version'] for r in source), key=lambda s:s.encode('utf-16-be'))]
    return dict(sourceCount=len(source),versionProfile=version_profile,sourceIds=[r['id'] for r in source],eligibleCount=len(included),eligibleIds=[r['id'] for r in included],excluded=excluded,missing=missing,coverage=coverage,raw=raw,strata=qualified,omittedStrata=sparse,analyzedIds=[i for s in qualified for i in s['ids']] if config['stratify'] else [r['id'] for r in included],rates=rates,ratio=ratio,difference=difference,state=state)

def compare(expected, actual, location):
    if isinstance(expected, dict):
        for k,v in expected.items():
            require(k in actual, f'{location}: missing {k}')
            compare(v, actual[k], f'{location}.{k}')
    elif isinstance(expected, list):
        require(isinstance(actual,list) and len(expected)==len(actual), f'{location}: list length differs')
        for i,(a,b) in enumerate(zip(expected,actual)): compare(a,b,f'{location}[{i}]')
    elif isinstance(expected, (float,int)) and not isinstance(expected,bool):
        close(expected,actual,f'{location}: {actual} != recalculated {expected}')
    else:
        require(expected==actual,f'{location}: {actual!r} != {expected!r}')

def check_reason(decision, maps):
    factors={'Insufficient credit history':'credit_history','High revolving utilization':'utilization','Debt obligations relative to income':'dti','Outside eligible service area':'geography'}
    result=[]
    mapping=next((m for m in maps if m['version']==decision['mapper']),None)
    effective=decision.get('replayedAt',decision['timestamp'])[:10]
    map_valid=mapping is not None and mapping['effectiveFrom']<=effective<=mapping['effectiveTo']
    for reason in decision['reasons']:
        lineage=decision['lineage']; factor=factors.get(reason)
        result.append('Cannot verify' if not map_valid or not lineage or not factor else 'Verified' if factor in lineage['considered'] and factor in lineage['principal'] else 'Inconsistent')
    return result

def fingerprint(value):
    text=json.dumps(value,ensure_ascii=False,separators=(',',':'),allow_nan=False)
    data=text.encode('utf-16-le')
    result=2166136261
    for i in range(0,len(data),2):
        result=((result ^ (data[i] | data[i+1]<<8))*16777619) & 0xffffffff
    return 'fnv1a32-'+format(result,'08x')

def verify_import(bundle):
    review=bundle['review']; runs=review['runs']
    require(bool(runs),'Review has no runs')
    require(len({r['id'] for r in runs})==len(runs),'Duplicate run IDs')
    fields=['id','applicantId','timestamp','decision','channel','version','cohort','riskBand']
    for run in runs:
        headers=run['source']['headers']; source=run['source']['rows']; mapping=run['mapping']; labels=run['labels']
        require(len(headers)==len(set(headers)) and all(isinstance(h,str) and h for h in headers),'Invalid source headers')
        require(len(source)<=20000,'Too many source rows')
        require(all(mapping.get(k) in headers for k in fields) and len(set(mapping.values()))==len(fields),'Invalid mapping')
        a,b=labels['comparison'],labels['reference']
        require(a and b and a!=b and a==a.strip() and b==b.strip(),'Invalid cohort labels')
        require(labels==runs[0]['labels'],'Cohort definitions changed within review')
        accepted=[]; rejected=[]; seen=set()
        for i,row in enumerate(source):
            require(len(row)==len(headers) and all(isinstance(v,str) for v in row),'Invalid source row')
            v={k:row[headers.index(mapping[k])].strip() for k in fields}; reasons=[]
            for k in fields:
                if k!='cohort' and not v[k]: reasons.append(k+' is required')
            if v['id'] in seen: reasons.append('Duplicate application ID')
            seen.add(v['id'])
            try:
                date=datetime.date.fromisoformat(v['timestamp'])
                valid=date.isoformat()==v['timestamp']
            except ValueError: valid=False
            if not valid: reasons.append('Decision date must be a valid YYYY-MM-DD')
            if v['decision'] not in ['Approved','Denied','Withdrawn','Incomplete']: reasons.append('Unsupported outcome')
            if v['cohort'] and v['cohort'] not in [a,b]: reasons.append('Cohort differs from the two configured labels')
            if reasons: rejected.append(dict(row=i+2,reasons=reasons))
            else:
                v['cohort']='Cohort A' if v['cohort']==a else 'Cohort B' if v['cohort']==b else None
                accepted.append(v)
        compare(dict(accepted=accepted,rejected=rejected,sourceCount=len(source)),run['qualification'],run['id']+'.qualification')
        require(bool(accepted),'No accepted rows')
        require(fingerprint(accepted)==run['hash'],'Imported row fingerprint mismatch')
        c=run['config']; require(c['methodVersion']=='Stratified Screen v2.0','Unsupported method')
        require(isinstance(c['minimum'],int) and 1<=c['minimum']<=10000 and 0<c['threshold']<=1,'Invalid threshold or minimum')
        require(c['approvedBy']=='Unapproved local exploratory run','Imported configuration claims an unsupported approval')
        require(c['reference']=='Cohort B' and c['channel']=='All' and c['version']=='All','Unsupported imported scope')
        require(c['population'] in ['covered-only','all-applications'] and c['maxMissing']==0.2 and isinstance(c['stratify'],bool),'Invalid import configuration')
        dates=sorted(r['timestamp'] for r in accepted)
        require(c['from']==dates[0] and c['to']==dates[-1],'Source window mismatch')
        require(c['rationale']==run['rationale'] and len(run['rationale'].strip())>=12,'Missing or mismatched rationale')
        compare(c,run['result']['config'],run['id']+'.result.config')
        compare(replay(accepted,c),run['result'],run['id']+'.result')
    run_by_id={r['id']:r for r in runs}
    for finding in review.get('findings',[]):
        require(finding['runId'] in run_by_id,'Finding references missing baseline')
        for challenge in finding['challenges']:
            responses={r['id']:r for r in challenge['responses']}
            for disposition in challenge.get('dispositions',[]):
                require(disposition['responseId'] in responses,'Disposition references missing response')
                require(disposition['actor']!=responses[disposition['responseId']]['actor'],'Self-disposition is unsupported')
        if finding['status']=='Closed':
            retest=finding['retest']; closure=finding['closure']
            require(retest and retest['runId'] in run_by_id,'Closure lacks retest')
            require(closure['actor']!=retest['submittedBy'],'Self-approval is unsupported')
            require(closure['runId']==retest['runId'],'Closure and retest differ')
            require(finding['challenges'] and all(c['status']=='Supported' for c in finding['challenges']),'Closure has unresolved challenges')
            prior=run_by_id[finding['runId']]; current=run_by_id[retest['runId']]
            require(runs.index(current)>runs.index(prior),'Retest is not later than baseline')
            require(retest['passed'] and current['result']['state']=='No screen trigger','Closure lacks a passing retest')
            for k in ['threshold','minimum','stratify','population','maxMissing','reference']:
                require(prior['config'][k]==current['config'][k],'Closure changed the approved protocol')
    return f"PASS: {len(runs)} imported runs independently replayed from mapped source rows, including rejection, eligibility, coverage, strata, rates and result states. Consistency verification is not source authenticity or methodological validation."

def verify(bundle):
    if bundle.get('schema')=='avarent-import-review-v1': return verify_import(bundle)
    require(bundle.get('schema')=='avarent-review-2','Full second-line v2 bundle required; shared exports deliberately omit analytical data.')
    rows=bundle['dataset']['rows']; require(len(rows)==12481,'Unexpected canonical source count')
    require(len({r['id'] for r in rows})==len(rows),'Duplicate application identifiers')
    require(fingerprint(rows)==bundle['dataset']['hash'],'Dataset content no longer matches its consistency fingerprint')
    for artifact in bundle['artifacts']:
        require(fingerprint(artifact['content'])==artifact['hash'],'Artifact content changed: '+artifact['id'])
    configs={c['id']:c for c in bundle['configs']}
    for run in bundle['runs']:
        require(run['config']['id'] in configs,'Missing saved configuration')
        compare(configs[run['config']['id']],run['config'],run['id']+'.configuration')
        require(run['dataset']==bundle['dataset']['id'],'Dataset version drift')
        require(run['datasetHash']==bundle['dataset']['hash'],'Dataset fingerprint reference drift')
        require(run['config']['methodVersion']==bundle['methods']['version'],'Unsupported or changed method version')
        compare(replay(rows,run['config']),run['result'],run['id'])
    for row in rows:
        states=check_reason(row,bundle['reasonMaps'])
        expected='Not applicable' if not states else 'Inconsistent' if 'Inconsistent' in states else 'Cannot verify' if 'Cannot verify' in states else 'Verified'
        require(row['integrity']==expected,'Reason integrity differs: '+row['id'])
    rr=bundle['reasonReplay']; require(check_reason(rr['corrected'],bundle['reasonMaps'])==[c['state'] for c in rr['checks']],'Reason replay checks differ')
    require(check_reason(rr['original'],bundle['reasonMaps'])[0]=='Inconsistent','Original inconsistency was not retained')
    require(all(s=='Verified' for s in check_reason(rr['corrected'],bundle['reasonMaps'])),'Corrected replay is unsupported')
    artifacts={a['id'] for a in bundle['artifacts']}; run_ids={r['id'] for r in bundle['runs']}; challenges={c['id']:c for c in bundle['challenges']}
    for f in bundle['findings']:
        require(set(f['artifactIds'])<=artifacts,'Finding links unavailable artifacts')
        require(set(f['runIds'])<=run_ids,'Finding links unavailable runs')
        require(set(f['challengeIds'])<=set(challenges),'Finding links unavailable challenges')
        if f['status']=='Closed' and f['retestRequired']:
            require(any(r['findingId']==f['id'] and r['passed'] for r in bundle['retests']),'Closed finding lacks successful retest')
            require(all(challenges[c]['status']=='Supported' for c in f['challengeIds']),'Closed finding has unresolved challenge')
    for c in challenges.values():
        response_ids={r['id'] for r in c['responses']}
        for d in c['dispositions']:
            require(d['responseId'] in response_ids,'Disposition lost response origin')
            require(bool(d['rationale'].strip()),'Disposition lacks rationale')
    return f"PASS: {len(rows):,} rows, {len(bundle['runs'])} independent descriptive replays, original/corrected reason checks and linked closure prerequisites. No claim about production security, model validity or legal compliance."

if __name__=='__main__':
    try:
        with open(sys.argv[1],encoding='utf-8') as f: record=json.load(f)
        print(verify(record))
    except (ValueError,KeyError,TypeError,IndexError,ZeroDivisionError,OSError) as exc:
        print('FAIL:',exc,file=sys.stderr);sys.exit(1)