package releaseevidence

import (
	"archive/zip"
	"encoding/json"
	"fmt"
	"os"
	"path/filepath"
	"slices"
	"strings"
	"testing"
	"time"

	"data-terminal-cloud/internal/agentmodelsconformance"
	"data-terminal-cloud/internal/alertreceiverconformance"
	"data-terminal-cloud/internal/cisupplychainconformance"
	"data-terminal-cloud/internal/firmwareconformance"
	"data-terminal-cloud/internal/infrastructureconformance"
	"data-terminal-cloud/internal/kmsrotationconformance"
	"data-terminal-cloud/internal/recoveryconformance"
	"data-terminal-cloud/internal/rtcconformance"
	"data-terminal-cloud/internal/safariconformance"
)

const fixtureSourceCommit = "1111111111111111111111111111111111111111"

func TestBuildCreatesHashedBundleAndPreservesPendingGates(t *testing.T) {
	t.Parallel()
	root, snapshotPath, indexPath, outputPath := releaseFixture(t, true)
	result, err := Build(Options{
		Root: root, CandidateVersion: "0.53.0-rc.local", BuildDigest: "sha256:" + strings.Repeat("a", 64),
		SourceCommit: fixtureSourceCommit, AcceptanceSnapshotPath: snapshotPath, EvidenceIndexPath: indexPath,
		OutputPath: outputPath, GeneratedAt: time.Date(2026, 8, 25, 12, 0, 0, 0, time.UTC),
	})
	if err != nil {
		t.Fatal(err)
	}
	if result.Status != "EXTERNAL_VALIDATION_PENDING" || result.Verified != 1 || result.Pending != len(requiredCodes)-1 || result.Waived != 0 || !strings.HasPrefix(result.SHA256, "sha256:") {
		t.Fatalf("unexpected result: %+v", result)
	}
	reader, err := zip.OpenReader(outputPath)
	if err != nil {
		t.Fatal(err)
	}
	defer reader.Close()
	entries := map[string]*zip.File{}
	for _, entry := range reader.File {
		entries[entry.Name] = entry
	}
	for _, required := range []string{"release-manifest.json", "evidence-index.json", "acceptance/technical-acceptance-snapshot.json", "baseline/openapi/openapi.yaml", "baseline/openapi/onboarding.yaml", "evidence/REMOTE_CI_SUPPLY_CHAIN/01-ci-report.json"} {
		if entries[required] == nil {
			t.Fatalf("bundle entry missing: %s", required)
		}
	}
	manifestReader, _ := entries["release-manifest.json"].Open()
	defer manifestReader.Close()
	var bundleManifest manifest
	if err = json.NewDecoder(manifestReader).Decode(&bundleManifest); err != nil {
		t.Fatal(err)
	}
	if !bundleManifest.TechnicalGateSatisfied || bundleManifest.PendingCount != len(requiredCodes)-1 || bundleManifest.SBOMCount != 0 || len(bundleManifest.Warnings) != 1 {
		t.Fatalf("unexpected manifest: %+v", bundleManifest)
	}
	if len(bundleManifest.Files) != result.Files-1 {
		t.Fatalf("manifest file inventory=%d bundle files=%d", len(bundleManifest.Files), result.Files)
	}
	indexReader, _ := entries["evidence-index.json"].Open()
	defer indexReader.Close()
	var packagedIndex EvidenceIndex
	if err = json.NewDecoder(indexReader).Decode(&packagedIndex); err != nil || packagedIndex.Items[0].Files[0] != "evidence/REMOTE_CI_SUPPLY_CHAIN/01-ci-report.json" {
		t.Fatalf("packaged evidence paths were not sanitized: %+v err=%v", packagedIndex.Items[0].Files, err)
	}
}

func TestBuildRejectsUnsatisfiedAcceptanceAndProductionLocalLabel(t *testing.T) {
	t.Parallel()
	root, snapshotPath, indexPath, outputPath := releaseFixture(t, false)
	_, err := Build(Options{Root: root, CandidateVersion: "0.53.0-rc.local", BuildDigest: "sha256:" + strings.Repeat("a", 64), SourceCommit: fixtureSourceCommit, AcceptanceSnapshotPath: snapshotPath, EvidenceIndexPath: indexPath, OutputPath: outputPath})
	if err == nil || !strings.Contains(err.Error(), "technical gate") {
		t.Fatalf("expected technical gate rejection, got %v", err)
	}
	writeJSONFile(t, snapshotPath, acceptanceSnapshot{
		ID: "10000000-0000-0000-0000-000000000001", CandidateVersion: "0.53.0-rc.local", BuildDigest: "sha256:" + strings.Repeat("a", 64),
		Environment: "PRODUCTION", RunType: "PRODUCTION_RELEASE", GeneratedAt: time.Now().UTC(), RedactionPolicy: "ops-acceptance-minimal-v1", OverallGateSatisfied: true,
	})
	_, err = Build(Options{Root: root, CandidateVersion: "0.53.0-rc.local", BuildDigest: "sha256:" + strings.Repeat("a", 64), SourceCommit: "local-uncommitted", AcceptanceSnapshotPath: snapshotPath, EvidenceIndexPath: indexPath, OutputPath: outputPath})
	if err == nil || !strings.Contains(err.Error(), "source commit") {
		t.Fatalf("expected production source commit rejection, got %v", err)
	}
}

func TestBuildRequiresAndPackagesCompletePilotWeek(t *testing.T) {
	t.Parallel()
	root, snapshotPath, indexPath, outputPath := releaseFixture(t, true)
	writeJSONFile(t, snapshotPath, acceptanceSnapshot{
		ID: "10000000-0000-0000-0000-000000000001", CandidateVersion: "0.53.0-rc.local", BuildDigest: "sha256:" + strings.Repeat("a", 64),
		Environment: "LAB", RunType: "PILOT", TenantID: "20000000-0000-0000-0000-000000000001", GeneratedAt: time.Now().UTC(), RedactionPolicy: "ops-acceptance-minimal-v1", OverallGateSatisfied: true,
	})
	baseOptions := Options{
		Root: root, CandidateVersion: "0.53.0-rc.local", BuildDigest: "sha256:" + strings.Repeat("a", 64), SourceCommit: fixtureSourceCommit,
		AcceptanceSnapshotPath: snapshotPath, EvidenceIndexPath: indexPath, OutputPath: outputPath, GeneratedAt: time.Date(2026, 8, 25, 12, 0, 0, 0, time.UTC),
	}
	if _, err := Build(baseOptions); err == nil || !strings.Contains(err.Error(), "exactly seven") {
		t.Fatalf("expected missing PILOT cycle rejection, got %v", err)
	}
	location, err := time.LoadLocation("Asia/Shanghai")
	if err != nil {
		t.Fatal(err)
	}
	weekStart := time.Date(2026, 8, 10, 0, 0, 0, 0, location)
	weeklyPath := filepath.Join(root, "pilot-weekly.json")
	writeJSONFile(t, weeklyPath, pilotWeeklySnapshot{
		ID: "30000000-0000-0000-0000-000000000001", GeneratedAt: weekStart.AddDate(0, 0, 7).Add(time.Hour).UTC(),
		TenantID: "20000000-0000-0000-0000-000000000001", CandidateVersion: "0.53.0-rc.local", BuildDigest: "sha256:" + strings.Repeat("a", 64), WeekStart: "2026-08-10", Timezone: "Asia/Shanghai",
		WindowStart: weekStart.UTC(), WindowEnd: weekStart.AddDate(0, 0, 7).UTC(), IsComplete: true, RedactionPolicy: "ops-pilot-weekly-minimal-v1",
		ExternalEvidence: []PilotWeeklyExternalEvidence{{Code: "complaints", Status: "REQUIRED"}},
	})
	dailyPaths := []string{}
	for day := 0; day < 7; day++ {
		date := weekStart.AddDate(0, 0, day)
		path := filepath.Join(root, "pilot-daily-"+date.Format("2006-01-02")+".json")
		writeJSONFile(t, path, pilotDailySnapshot{
			ID: fmt.Sprintf("40000000-0000-0000-0000-%012d", day+1), GeneratedAt: date.Add(12 * time.Hour).UTC(),
			TenantID: "20000000-0000-0000-0000-000000000001", CandidateVersion: "0.53.0-rc.local", BuildDigest: "sha256:" + strings.Repeat("a", 64), LocalDate: date.Format("2006-01-02"), Timezone: "Asia/Shanghai",
			WindowStart: date.UTC(), WindowEnd: date.AddDate(0, 0, 1).UTC(), RedactionPolicy: "ops-pilot-daily-minimal-v1",
		})
		dailyPaths = append(dailyPaths, path)
	}
	baseOptions.PilotDailySnapshotPaths = dailyPaths
	baseOptions.PilotWeeklySnapshotPath = weeklyPath
	firstDate := weekStart
	writeJSONFile(t, dailyPaths[0], pilotDailySnapshot{
		ID: "40000000-0000-0000-0000-000000000001", GeneratedAt: firstDate.Add(12 * time.Hour).UTC(),
		TenantID: "20000000-0000-0000-0000-000000000001", CandidateVersion: "different-candidate", BuildDigest: "sha256:" + strings.Repeat("a", 64), LocalDate: firstDate.Format("2006-01-02"), Timezone: "Asia/Shanghai",
		WindowStart: firstDate.UTC(), WindowEnd: firstDate.AddDate(0, 0, 1).UTC(), RedactionPolicy: "ops-pilot-daily-minimal-v1",
	})
	if _, err = Build(baseOptions); err == nil || !strings.Contains(err.Error(), "candidate") {
		t.Fatalf("expected cross-candidate PILOT evidence rejection, got %v", err)
	}
	writeJSONFile(t, dailyPaths[0], pilotDailySnapshot{
		ID: "40000000-0000-0000-0000-000000000001", GeneratedAt: firstDate.Add(12 * time.Hour).UTC(),
		TenantID: "20000000-0000-0000-0000-000000000001", CandidateVersion: "0.53.0-rc.local", BuildDigest: "sha256:" + strings.Repeat("a", 64), LocalDate: firstDate.Format("2006-01-02"), Timezone: "Asia/Shanghai",
		WindowStart: firstDate.UTC(), WindowEnd: firstDate.AddDate(0, 0, 1).UTC(), RedactionPolicy: "ops-pilot-daily-minimal-v1",
	})
	result, err := Build(baseOptions)
	if err != nil {
		t.Fatal(err)
	}
	reader, err := zip.OpenReader(result.OutputPath)
	if err != nil {
		t.Fatal(err)
	}
	defer reader.Close()
	entries := map[string]*zip.File{}
	for _, entry := range reader.File {
		entries[entry.Name] = entry
	}
	if entries["pilot/weekly/2026-08-10.json"] == nil || entries["pilot/daily/2026-08-16.json"] == nil {
		t.Fatal("PILOT daily or weekly evidence is missing from bundle")
	}
	manifestReader, _ := entries["release-manifest.json"].Open()
	defer manifestReader.Close()
	var bundleManifest manifest
	if err = json.NewDecoder(manifestReader).Decode(&bundleManifest); err != nil || !bundleManifest.PilotEvidenceIncluded || bundleManifest.PilotDailyCount != 7 || bundleManifest.PilotWeekStart != "2026-08-10" || bundleManifest.PilotTimezone != "Asia/Shanghai" {
		t.Fatalf("unexpected PILOT manifest: %+v err=%v", bundleManifest, err)
	}
}

func TestFirmwareHardwareCoverageControlsVerifiedGate(t *testing.T) {
	t.Parallel()
	root, snapshotPath, indexPath, outputPath := releaseFixture(t, true)
	var index EvidenceIndex
	indexBytes, err := os.ReadFile(indexPath)
	if err != nil || json.Unmarshal(indexBytes, &index) != nil {
		t.Fatal("read evidence index", err)
	}
	reportPaths := []string{}
	for device := 1; device <= firmwareDeviceMinimum; device++ {
		for scenarioPosition, scenario := range requiredFirmwareScenarios {
			path := filepath.Join(root, fmt.Sprintf("firmware-%d-%s.json", device, strings.ToLower(scenario)))
			writeJSONFile(t, path, firmwareReportFixture(device, scenarioPosition, scenario, "HARDWARE_CAPTURE"))
			reportPaths = append(reportPaths, path)
		}
	}
	for position := range index.Items {
		if index.Items[position].Code == firmwareEvidenceCode {
			index.Items[position].Status = "VERIFIED"
			index.Items[position].Owner = "硬件与测试负责人"
			index.Items[position].Note = "三台候选设备四场景真机一致性报告"
			index.Items[position].Files = reportPaths
		}
	}
	writeJSONFile(t, indexPath, index)
	result, err := Build(Options{
		Root: root, CandidateVersion: "0.53.0-rc.local", BuildDigest: "sha256:" + strings.Repeat("a", 64),
		SourceCommit: fixtureSourceCommit, AcceptanceSnapshotPath: snapshotPath, EvidenceIndexPath: indexPath,
		OutputPath: outputPath, GeneratedAt: time.Date(2026, 8, 25, 12, 0, 0, 0, time.UTC),
	})
	if err != nil {
		t.Fatal(err)
	}
	reader, err := zip.OpenReader(result.OutputPath)
	if err != nil {
		t.Fatal(err)
	}
	defer reader.Close()
	for _, entry := range reader.File {
		if entry.Name != "release-manifest.json" {
			continue
		}
		manifestReader, _ := entry.Open()
		defer manifestReader.Close()
		var bundleManifest manifest
		if err = json.NewDecoder(manifestReader).Decode(&bundleManifest); err != nil {
			t.Fatal(err)
		}
		if !bundleManifest.FirmwareValidation.CoverageComplete || bundleManifest.FirmwareValidation.QualifiedDeviceCount != 3 || bundleManifest.FirmwareValidation.ReportCount != 12 || len(bundleManifest.FirmwareValidation.Gaps) != 0 {
			t.Fatalf("unexpected firmware coverage: %+v", bundleManifest.FirmwareValidation)
		}
	}

	index.Items[2].Files = index.Items[2].Files[:len(index.Items[2].Files)-1]
	writeJSONFile(t, indexPath, index)
	_, err = Build(Options{
		Root: root, CandidateVersion: "0.53.0-rc.local", BuildDigest: "sha256:" + strings.Repeat("a", 64),
		SourceCommit: fixtureSourceCommit, AcceptanceSnapshotPath: snapshotPath, EvidenceIndexPath: indexPath,
		OutputPath: filepath.Join(root, "out", "incomplete.zip"),
	})
	if err == nil || !strings.Contains(err.Error(), "must remain PENDING") {
		t.Fatalf("expected incomplete hardware suite rejection, got %v", err)
	}
}

func TestFirmwareEvidenceRejectsSimulatorReport(t *testing.T) {
	t.Parallel()
	root, snapshotPath, indexPath, outputPath := releaseFixture(t, true)
	path := filepath.Join(root, "simulator-report.json")
	writeJSONFile(t, path, firmwareReportFixture(1, 0, "AB_SUCCESS", "PROTOCOL_SIMULATION"))
	var index EvidenceIndex
	content, _ := os.ReadFile(indexPath)
	if err := json.Unmarshal(content, &index); err != nil {
		t.Fatal(err)
	}
	for position := range index.Items {
		if index.Items[position].Code == firmwareEvidenceCode {
			index.Items[position].Files = []string{path}
		}
	}
	writeJSONFile(t, indexPath, index)
	_, err := Build(Options{
		Root: root, CandidateVersion: "0.53.0-rc.local", BuildDigest: "sha256:" + strings.Repeat("a", 64), SourceCommit: fixtureSourceCommit,
		AcceptanceSnapshotPath: snapshotPath, EvidenceIndexPath: indexPath, OutputPath: outputPath,
	})
	if err == nil || !strings.Contains(err.Error(), "HARDWARE_CAPTURE") {
		t.Fatalf("expected simulator evidence rejection, got %v", err)
	}
}

func TestRealAlertReceiverReportControlsEvidenceGate(t *testing.T) {
	t.Parallel()
	root, _, indexPath, _ := releaseFixture(t, true)
	path := filepath.Join(root, "real-alert-receiver-report.json")
	writeJSONFile(t, path, alertReceiverReportFixture("REAL_RECEIVER", false))
	var index EvidenceIndex
	content, _ := os.ReadFile(indexPath)
	if err := json.Unmarshal(content, &index); err != nil {
		t.Fatal(err)
	}
	for position := range index.Items {
		if index.Items[position].Code == alertReceiverEvidenceCode {
			index.Items[position].Status = "VERIFIED"
			index.Items[position].Files = []string{path}
		}
	}
	summary, err := validateAlertReceiverEvidence(index, root, "0.53.0-rc.local", "sha256:"+strings.Repeat("a", 64))
	if err != nil || !summary.CoverageComplete || !summary.FormalDrillVerified || summary.ActiveRouteCount != 1 {
		t.Fatalf("unexpected real receiver summary=%+v err=%v", summary, err)
	}
	writeJSONFile(t, path, alertReceiverReportFixture("MOCK_RECEIVER", true))
	if _, err = validateAlertReceiverEvidence(index, root, "0.53.0-rc.local", "sha256:"+strings.Repeat("a", 64)); err == nil || !strings.Contains(err.Error(), "REAL_RECEIVER") {
		t.Fatalf("expected mock receiver rejection, got %v", err)
	}
}

func TestRealKMSRotationReportControlsEvidenceGate(t *testing.T) {
	t.Parallel()
	root, _, indexPath, _ := releaseFixture(t, true)
	path := filepath.Join(root, "real-kms-rotation-report.json")
	writeJSONFile(t, path, kmsRotationReportFixture("REAL_KMS_HSM", false))
	var index EvidenceIndex
	content, _ := os.ReadFile(indexPath)
	if err := json.Unmarshal(content, &index); err != nil {
		t.Fatal(err)
	}
	for position := range index.Items {
		if index.Items[position].Code == kmsRotationEvidenceCode {
			index.Items[position].Status = "VERIFIED"
			index.Items[position].Files = []string{path}
		}
	}
	summary, err := validateKMSRotationEvidence(index, root, "0.53.0-rc.local", "sha256:"+strings.Repeat("a", 64))
	if err != nil || !summary.CoverageComplete || summary.RotationCount != 2 || len(summary.ConsumptionModes) != 2 {
		t.Fatalf("unexpected KMS summary=%+v err=%v", summary, err)
	}
	writeJSONFile(t, path, kmsRotationReportFixture("LOCAL_SECRET", true))
	if _, err = validateKMSRotationEvidence(index, root, "0.53.0-rc.local", "sha256:"+strings.Repeat("a", 64)); err == nil || !strings.Contains(err.Error(), "REAL_KMS_HSM") {
		t.Fatalf("expected local rotation rejection, got %v", err)
	}
}

func TestProductionRecoveryReportControlsEvidenceGate(t *testing.T) {
	t.Parallel()
	root, _, indexPath, _ := releaseFixture(t, true)
	path := filepath.Join(root, "production-recovery-report.json")
	writeJSONFile(t, path, productionRecoveryReportFixture("PRODUCTION_EQUIVALENT", false))
	var index EvidenceIndex
	content, _ := os.ReadFile(indexPath)
	if err := json.Unmarshal(content, &index); err != nil {
		t.Fatal(err)
	}
	for position := range index.Items {
		if index.Items[position].Code == productionRecoveryEvidenceCode {
			index.Items[position].Status = "VERIFIED"
			index.Items[position].Files = []string{path}
		}
	}
	summary, err := validateProductionRecoveryEvidence(index, root, "0.53.0-rc.local", "sha256:"+strings.Repeat("a", 64))
	if err != nil || !summary.CoverageComplete || summary.DrillCount != 4 || len(summary.CompletedDrillTypes) != 4 {
		t.Fatalf("unexpected recovery summary=%+v err=%v", summary, err)
	}
	writeJSONFile(t, path, productionRecoveryReportFixture("LOCAL_RECOVERY", true))
	if _, err = validateProductionRecoveryEvidence(index, root, "0.53.0-rc.local", "sha256:"+strings.Repeat("a", 64)); err == nil || !strings.Contains(err.Error(), "PRODUCTION_EQUIVALENT") {
		t.Fatalf("expected local recovery rejection, got %v", err)
	}
}

func TestProductionInfrastructureReportControlsEvidenceGate(t *testing.T) {
	t.Parallel()
	root, _, indexPath, _ := releaseFixture(t, true)
	path := filepath.Join(root, "production-infrastructure-report.json")
	writeJSONFile(t, path, productionInfrastructureReportFixture("PRODUCTION_INFRASTRUCTURE", false))
	var index EvidenceIndex
	content, _ := os.ReadFile(indexPath)
	if err := json.Unmarshal(content, &index); err != nil {
		t.Fatal(err)
	}
	for position := range index.Items {
		if index.Items[position].Code == productionInfrastructureEvidenceCode {
			index.Items[position].Status = "VERIFIED"
			index.Items[position].Files = []string{path}
		}
	}
	summary, err := validateProductionInfrastructureEvidence(index, root, "0.53.0-rc.local", "sha256:"+strings.Repeat("a", 64))
	if err != nil || !summary.CoverageComplete || summary.ComponentCount != len(infrastructureconformance.RequiredComponents) || len(summary.VerifiedComponents) != len(infrastructureconformance.RequiredComponents) {
		t.Fatalf("unexpected infrastructure summary=%+v err=%v", summary, err)
	}
	writeJSONFile(t, path, productionInfrastructureReportFixture("LOCAL_INFRASTRUCTURE", true))
	if _, err = validateProductionInfrastructureEvidence(index, root, "0.53.0-rc.local", "sha256:"+strings.Repeat("a", 64)); err == nil || !strings.Contains(err.Error(), "PRODUCTION_INFRASTRUCTURE") {
		t.Fatalf("expected local infrastructure rejection, got %v", err)
	}
}

func TestSafariCompatibilityReportControlsEvidenceGate(t *testing.T) {
	t.Parallel()
	root, _, indexPath, _ := releaseFixture(t, true)
	path := filepath.Join(root, "safari-compatibility-report.json")
	writeJSONFile(t, path, safariCompatibilityReportFixture("REAL_SAFARI", false))
	var index EvidenceIndex
	content, _ := os.ReadFile(indexPath)
	if err := json.Unmarshal(content, &index); err != nil {
		t.Fatal(err)
	}
	for position := range index.Items {
		if index.Items[position].Code == safariCompatibilityEvidenceCode {
			index.Items[position].Status = "VERIFIED"
			index.Items[position].Files = []string{path}
		}
	}
	summary, err := validateSafariCompatibilityEvidence(index, root, "0.53.0-rc.local", "sha256:"+strings.Repeat("a", 64))
	if err != nil || !summary.CoverageComplete || summary.RunCount != 2 || summary.ResultCount != 24 {
		t.Fatalf("unexpected Safari summary=%+v err=%v", summary, err)
	}
	writeJSONFile(t, path, safariCompatibilityReportFixture("NON_SAFARI_TOOLCHAIN", true))
	if _, err = validateSafariCompatibilityEvidence(index, root, "0.53.0-rc.local", "sha256:"+strings.Repeat("a", 64)); err == nil || !strings.Contains(err.Error(), "REAL_SAFARI") {
		t.Fatalf("expected non-Safari rejection, got %v", err)
	}
}

func TestRealDeviceRTCReportControlsEvidenceGate(t *testing.T) {
	t.Parallel()
	root, _, indexPath, _ := releaseFixture(t, true)
	path := filepath.Join(root, "real-device-rtc-report.json")
	writeJSONFile(t, path, realDeviceRTCReportFixture("REAL_DEVICE_RTC_PROVIDER", false))
	var index EvidenceIndex
	content, _ := os.ReadFile(indexPath)
	if err := json.Unmarshal(content, &index); err != nil {
		t.Fatal(err)
	}
	for position := range index.Items {
		if index.Items[position].Code == realDeviceRTCEvidenceCode {
			index.Items[position].Status = "VERIFIED"
			index.Items[position].Files = []string{path}
		}
	}
	summary, err := validateRealDeviceRTCEvidence(index, root, "0.53.0-rc.local", "sha256:"+strings.Repeat("a", 64))
	if err != nil || !summary.CoverageComplete || summary.DeviceCount != 3 || summary.SessionCount != 6 || len(summary.CompletedEngineModes) != 3 || len(summary.CompletedScenarios) != 4 {
		t.Fatalf("unexpected RTC summary=%+v err=%v", summary, err)
	}
	writeJSONFile(t, path, realDeviceRTCReportFixture("PROTOCOL_SIMULATION", true))
	if _, err = validateRealDeviceRTCEvidence(index, root, "0.53.0-rc.local", "sha256:"+strings.Repeat("a", 64)); err == nil || !strings.Contains(err.Error(), "REAL_DEVICE_RTC_PROVIDER") {
		t.Fatalf("expected protocol simulation rejection, got %v", err)
	}
}

func TestRealAgentModelsReportControlsEvidenceGate(t *testing.T) {
	t.Parallel()
	root, _, indexPath, _ := releaseFixture(t, true)
	path := filepath.Join(root, "real-agent-models-report.json")
	writeJSONFile(t, path, realAgentModelsReportFixture("REAL_AGENT_MODELS", false))
	var index EvidenceIndex
	content, _ := os.ReadFile(indexPath)
	if err := json.Unmarshal(content, &index); err != nil {
		t.Fatal(err)
	}
	for position := range index.Items {
		if index.Items[position].Code == realAgentModelsEvidenceCode {
			index.Items[position].Status = "VERIFIED"
			index.Items[position].Files = []string{path}
		}
	}
	summary, err := validateRealAgentModelsEvidence(index, root, "0.53.0-rc.local", "sha256:"+strings.Repeat("a", 64))
	if err != nil || !summary.CoverageComplete || summary.GenerationCaseCount != 10 || len(summary.EmbeddingCategories) != 6 || len(summary.ContentSafetyCategories) != 6 {
		t.Fatalf("unexpected Agent models summary=%+v err=%v", summary, err)
	}
	writeJSONFile(t, path, realAgentModelsReportFixture("LOCAL_AGENT_TOOLCHAIN", true))
	if _, err = validateRealAgentModelsEvidence(index, root, "0.53.0-rc.local", "sha256:"+strings.Repeat("a", 64)); err == nil || !strings.Contains(err.Error(), "REAL_AGENT_MODELS") {
		t.Fatalf("expected local Agent models rejection, got %v", err)
	}
}

func releaseFixture(t *testing.T, gateSatisfied bool) (string, string, string, string) {
	t.Helper()
	root := t.TempDir()
	files := []string{
		"openapi/openapi.yaml", "openapi/onboarding.yaml", "compose.yaml", ".github/workflows/ci.yml", "go.mod", "go.sum", "web/package.json", "web/package-lock.json",
		"docs/development-plan.md", "docs/development-status.md", "docs/requirements-traceability.md", "docs/external-acceptance-checklist.md",
		"docs/kubernetes-deployment.md", "docs/alert-operations.md", "docs/integration-diagnostics.md", "migrations/000001.up.sql", "deploy/kubernetes/base/api.yaml",
		"docs/content-safety-provider.md", "docs/remote-ci-supply-chain-evidence.md", "docs/real-device-rtc-evidence.md", "docs/real-agent-models-evidence.md", "docs/production-infrastructure-evidence.md", "docs/safari-compatibility-evidence.md", "docs/pilot-daily-operations.md", "docs/pilot-weekly-review.md",
	}
	for _, relative := range files {
		path := filepath.Join(root, filepath.FromSlash(relative))
		if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
			t.Fatal(err)
		}
		content := relative + "\n"
		if relative == "openapi/openapi.yaml" {
			content = "openapi: 3.1.0\ninfo:\n  title: test\n  version: 0.54.0\n"
		}
		if err := os.WriteFile(path, []byte(content), 0o644); err != nil {
			t.Fatal(err)
		}
	}
	snapshotPath := filepath.Join(root, "snapshot.json")
	writeJSONFile(t, snapshotPath, acceptanceSnapshot{
		ID: "10000000-0000-0000-0000-000000000001", CandidateVersion: "0.53.0-rc.local", BuildDigest: "sha256:" + strings.Repeat("a", 64),
		Environment: "LAB", RunType: "REAL_DEVICE_PROVIDER", GeneratedAt: time.Now().UTC(), RedactionPolicy: "ops-acceptance-minimal-v1", OverallGateSatisfied: gateSatisfied,
	})
	evidencePath := filepath.Join(root, "ci-report.json")
	writeJSONFile(t, evidencePath, ciSupplyChainReportFixture())
	index := EvidenceIndex{SchemaVersion: IndexSchemaVersion, CandidateVersion: "0.53.0-rc.local", BuildDigest: "sha256:" + strings.Repeat("a", 64)}
	for indexPosition, code := range requiredCodes {
		item := EvidenceItem{Code: code, Status: "PENDING", Owner: "待外部责任人确认", Note: "外部环境待验证", Files: []string{}}
		if indexPosition == 0 {
			item.Status = "VERIFIED"
			item.Owner = "研发"
			item.Note = "本地样例证据"
			item.Files = []string{"ci-report.json"}
		}
		index.Items = append(index.Items, item)
	}
	indexPath := filepath.Join(root, "evidence-index.json")
	writeJSONFile(t, indexPath, index)
	return root, snapshotPath, indexPath, filepath.Join(root, "out", "release.zip")
}

func ciSupplyChainReportFixture() cisupplychainconformance.Report {
	checks := make([]cisupplychainconformance.Check, 0, len(requiredRemoteCISupplyChainChecks))
	for _, code := range requiredRemoteCISupplyChainChecks {
		checks = append(checks, cisupplychainconformance.Check{Code: code, Status: "PASS", Detail: "fixture check passed"})
	}
	return cisupplychainconformance.Report{
		SchemaVersion: cisupplychainconformance.ReportSchema, Result: "PASS", GeneratedAt: time.Date(2026, 8, 25, 9, 30, 0, 0, time.UTC),
		CandidateVersion: "0.53.0-rc.local", BuildDigest: "sha256:" + strings.Repeat("a", 64), SourceCommit: fixtureSourceCommit,
		EvidenceScope: "REMOTE_CI_SUPPLY_CHAIN", ExternalValidationRequired: false, Provider: "GITHUB_ACTIONS", RunID: "123456", RunURL: "https://github.com/example/voice/actions/runs/123456",
		CompletedChecks: slices.Clone(cisupplychainconformance.RequiredChecks),
		ImageDigests:    map[string]string{"BACKEND_IMAGE": "sha256:" + strings.Repeat("b", 64), "WEB_IMAGE": "sha256:" + strings.Repeat("c", 64)},
		SBOMDigests:     map[string]string{"SOURCE": "sha256:" + strings.Repeat("d", 64), "BACKEND_IMAGE": "sha256:" + strings.Repeat("e", 64), "WEB_IMAGE": "sha256:" + strings.Repeat("f", 64)},
		InputSHA256:     map[string]string{"ci_capture": strings.Repeat("9", 64)}, Checks: checks, Disclaimer: "fixture remote CI evidence",
	}
}

func writeJSONFile(t *testing.T, path string, value any) {
	t.Helper()
	data, err := json.Marshal(value)
	if err != nil {
		t.Fatal(err)
	}
	if err = os.WriteFile(path, data, 0o644); err != nil {
		t.Fatal(err)
	}
}

func firmwareReportFixture(device, scenarioPosition int, scenario, scope string) firmwareconformance.Report {
	checks := make([]firmwareconformance.Check, 0, len(requiredFirmwareChecks))
	for _, code := range requiredFirmwareChecks {
		checks = append(checks, firmwareconformance.Check{Code: code, Status: "PASS", Detail: "fixture check passed"})
	}
	return firmwareconformance.Report{
		SchemaVersion: firmwareconformance.ReportSchema, Result: "PASS", GeneratedAt: time.Date(2026, 8, 25, 10, device, scenarioPosition, 0, time.UTC),
		CandidateVersion: "0.53.0-rc.local", BuildDigest: "sha256:" + strings.Repeat("a", 64), EvidenceScope: scope, ExternalValidationRequired: true,
		DeviceID: fmt.Sprintf("10000000-0000-0000-0000-%012d", device), ReleaseID: fmt.Sprintf("20000000-0000-0000-0000-%012d", scenarioPosition+1),
		RolloutID: fmt.Sprintf("30000000-0000-0000-%04d-%012d", device, scenarioPosition+1), CommandID: fmt.Sprintf("40000000-0000-0000-%04d-%012d", device, scenarioPosition+1),
		Scenario: scenario, CloudEventCount: 7, DeviceEventCount: 5,
		InputSHA256: map[string]string{"cloud_rollout": strings.Repeat("b", 64), "device_evidence": strings.Repeat("c", 64)},
		Checks:      checks, Disclaimer: "fixture retains external hardware review",
	}
}

func alertReceiverReportFixture(scope string, externalRequired bool) alertreceiverconformance.Report {
	checks := make([]alertreceiverconformance.Check, 0, len(requiredAlertReceiverChecks))
	for _, code := range requiredAlertReceiverChecks {
		checks = append(checks, alertreceiverconformance.Check{Code: code, Status: "PASS", Detail: "fixture check passed"})
	}
	return alertreceiverconformance.Report{
		SchemaVersion: alertreceiverconformance.ReportSchema, Result: "PASS", GeneratedAt: time.Date(2026, 8, 25, 12, 0, 0, 0, time.UTC),
		CandidateVersion: "0.53.0-rc.local", BuildDigest: "sha256:" + strings.Repeat("a", 64), EvidenceScope: scope, ExternalValidationRequired: externalRequired,
		TenantID: "10000000-0000-0000-0000-000000000001", ReceiverSystemRef: "pager-gateway:production", ActiveRouteCount: 1, MappedGroupCount: 2, TestReceiptCount: 1, FormalDrillVerified: true,
		RouteCoverage: []alertreceiverconformance.RouteCoverage{{RoutingPolicyID: "20000000-0000-0000-0000-000000000001", ReceiverGroup: "platform-oncall", TestRef: "30000000-0000-0000-0000-000000000001", Status: "PASS"}},
		InputSHA256:   map[string]string{"cloud_routes": strings.Repeat("1", 64), "cloud_tests": strings.Repeat("2", 64), "cloud_incident": strings.Repeat("3", 64), "receiver_capture": strings.Repeat("4", 64)},
		Checks:        checks, Disclaimer: "fixture retains business release approval boundary",
	}
}

func kmsRotationReportFixture(scope string, externalRequired bool) kmsrotationconformance.Report {
	checks := make([]kmsrotationconformance.Check, 0, len(requiredKMSRotationChecks))
	for _, code := range requiredKMSRotationChecks {
		checks = append(checks, kmsrotationconformance.Check{Code: code, Status: "PASS", Detail: "fixture check passed"})
	}
	return kmsrotationconformance.Report{
		SchemaVersion: kmsrotationconformance.ReportSchema, Result: "PASS", GeneratedAt: time.Date(2026, 8, 25, 12, 0, 0, 0, time.UTC),
		CandidateVersion: "0.53.0-rc.local", BuildDigest: "sha256:" + strings.Repeat("a", 64), EvidenceScope: scope, ExternalValidationRequired: externalRequired,
		Environment: "STAGING", ProviderRef: "cloud-secret-manager:voice-platform", RotationCount: 2, ConsumptionModes: []string{"DYNAMIC_READ", "ROLLING_RESTART"},
		InputSHA256: map[string]string{"rotation_capture": strings.Repeat("5", 64)}, Checks: checks, Disclaimer: "fixture retains business approval boundary",
	}
}

func productionRecoveryReportFixture(scope string, externalRequired bool) recoveryconformance.Report {
	checks := make([]recoveryconformance.Check, 0, len(requiredProductionRecoveryChecks))
	for _, code := range requiredProductionRecoveryChecks {
		checks = append(checks, recoveryconformance.Check{Code: code, Status: "PASS", Detail: "fixture check passed"})
	}
	durations := map[string]int{}
	for _, drillType := range recoveryconformance.RequiredDrillTypes {
		durations[drillType] = 120
	}
	return recoveryconformance.Report{
		SchemaVersion: recoveryconformance.ReportSchema, Result: "PASS", GeneratedAt: time.Date(2026, 8, 25, 12, 0, 0, 0, time.UTC),
		CandidateVersion: "0.53.0-rc.local", BuildDigest: "sha256:" + strings.Repeat("a", 64), EvidenceScope: scope, ExternalValidationRequired: externalRequired,
		Environment: "STAGING", InfrastructureRef: "cluster:staging-primary", DrillCount: 4, CompletedDrillTypes: slices.Clone(recoveryconformance.RequiredDrillTypes), ObservedRecoverySeconds: durations,
		InputSHA256: map[string]string{"recovery_capture": strings.Repeat("6", 64)}, Checks: checks, Disclaimer: "fixture retains release approval boundary",
	}
}

func productionInfrastructureReportFixture(scope string, externalRequired bool) infrastructureconformance.Report {
	checks := make([]infrastructureconformance.Check, 0, len(requiredProductionInfrastructureChecks))
	for _, code := range requiredProductionInfrastructureChecks {
		checks = append(checks, infrastructureconformance.Check{Code: code, Status: "PASS", Detail: "fixture check passed"})
	}
	controlCounts := map[string]int{}
	for _, component := range infrastructureconformance.RequiredComponents {
		controlCounts[component] = len(infrastructureconformance.RequiredControls(component))
	}
	return infrastructureconformance.Report{
		SchemaVersion: infrastructureconformance.ReportSchema, Result: "PASS", GeneratedAt: time.Date(2026, 8, 25, 12, 0, 0, 0, time.UTC),
		CandidateVersion: "0.53.0-rc.local", BuildDigest: "sha256:" + strings.Repeat("a", 64), EvidenceScope: scope, ExternalValidationRequired: externalRequired,
		Environment: "STAGING", RegionRef: "cn-region-a", ClusterRef: "cluster-a", ComponentCount: len(infrastructureconformance.RequiredComponents),
		VerifiedComponents: slices.Clone(infrastructureconformance.RequiredComponents), ControlCounts: controlCounts,
		InputSHA256: map[string]string{"infrastructure_capture": strings.Repeat("7", 64)}, Checks: checks, Disclaimer: "fixture retains release approval boundary",
	}
}

func safariCompatibilityReportFixture(scope string, externalRequired bool) safariconformance.Report {
	checks := make([]safariconformance.Check, 0, len(requiredSafariCompatibilityChecks))
	for _, code := range requiredSafariCompatibilityChecks {
		checks = append(checks, safariconformance.Check{Code: code, Status: "PASS", Detail: "fixture check passed"})
	}
	workflows := map[string]int{}
	for _, workflow := range safariconformance.RequiredWorkflows {
		workflows[workflow] = len(safariconformance.RequiredReleaseRanks) * len(safariconformance.RequiredViewports)
	}
	viewports := map[string]int{}
	for _, viewport := range safariconformance.RequiredViewports {
		viewports[viewport] = len(safariconformance.RequiredReleaseRanks) * len(safariconformance.RequiredWorkflows)
	}
	return safariconformance.Report{
		SchemaVersion: safariconformance.ReportSchema, Result: "PASS", GeneratedAt: time.Date(2026, 8, 25, 12, 0, 0, 0, time.UTC),
		CandidateVersion: "0.53.0-rc.local", BuildDigest: "sha256:" + strings.Repeat("a", 64), EvidenceScope: scope, ExternalValidationRequired: externalRequired,
		Environment: "STAGING", BrowserVersions: map[string]string{"CURRENT": "safari-current", "PREVIOUS": "safari-previous"}, RunCount: 2, ResultCount: 24,
		CompletedReleaseRanks: slices.Clone(safariconformance.RequiredReleaseRanks), CompletedWorkflows: workflows, CompletedViewports: viewports,
		InputSHA256: map[string]string{"safari_capture": strings.Repeat("8", 64)}, Checks: checks, Disclaimer: "fixture retains release approval boundary",
	}
}

func realDeviceRTCReportFixture(scope string, externalRequired bool) rtcconformance.Report {
	checks := make([]rtcconformance.Check, 0, len(requiredRealDeviceRTCChecks))
	for _, code := range requiredRealDeviceRTCChecks {
		checks = append(checks, rtcconformance.Check{Code: code, Status: "PASS", Detail: "fixture check passed"})
	}
	modes := map[string]int{"s2s_pure": 2, "s2s_hybrid": 2, "cascade": 2}
	scenarios := map[string]int{"NORMAL_COMPLETION": 3, "TOKEN_RENEWAL": 1, "NETWORK_SWITCH_RECOVERY": 1, "CONTROLLED_STOP": 1}
	return rtcconformance.Report{
		SchemaVersion: rtcconformance.ReportSchema, Result: "PASS", GeneratedAt: time.Date(2026, 8, 25, 12, 0, 0, 0, time.UTC),
		CandidateVersion: "0.53.0-rc.local", BuildDigest: "sha256:" + strings.Repeat("a", 64), EvidenceScope: scope, ExternalValidationRequired: externalRequired,
		Environment: "STAGING", RTCProviderRef: "volc-rtc:test", VoiceProviderRef: "doubao-voice:test", DeviceCount: 3, SessionCount: 6,
		CompletedEngineModes: slices.Clone(rtcconformance.RequiredEngineModes), CompletedScenarios: slices.Clone(rtcconformance.RequiredScenarios), ModeSessionCounts: modes, ScenarioSessionCounts: scenarios,
		InputSHA256: map[string]string{"rtc_capture": strings.Repeat("9", 64)}, Checks: checks, Disclaimer: "fixture retains release approval boundary",
	}
}

func realAgentModelsReportFixture(scope string, externalRequired bool) agentmodelsconformance.Report {
	checks := make([]agentmodelsconformance.Check, 0, len(requiredRealAgentModelsChecks))
	for _, code := range requiredRealAgentModelsChecks {
		checks = append(checks, agentmodelsconformance.Check{Code: code, Status: "PASS", Detail: "fixture check passed"})
	}
	return agentmodelsconformance.Report{
		SchemaVersion: agentmodelsconformance.ReportSchema, Result: "PASS", GeneratedAt: time.Date(2026, 8, 25, 12, 0, 0, 0, time.UTC),
		CandidateVersion: "0.53.0-rc.local", BuildDigest: "sha256:" + strings.Repeat("a", 64), EvidenceScope: scope, ExternalValidationRequired: externalRequired, Environment: "STAGING",
		GenerationProviderRef: "ark:generation", AgentVersion: "agent-v1", ModelConfigRef: "runtime-config-version:model-v1", SuiteVersion: "agent-quality-baseline-v1", GenerationCaseCount: 10,
		EmbeddingProviderRef: "ark:embedding", EmbeddingModelRef: "embedding-v1", EmbeddingQueryCount: 12, EmbeddingCategories: slices.Clone(agentmodelsconformance.RequiredEmbeddingCategories),
		ContentSafetyProviderRef: "managed:safety", ContentSafetyPolicyRef: "safety-v1", ContentSafetyCaseCount: 12, ContentSafetyCategories: slices.Clone(agentmodelsconformance.RequiredSafetyCategories),
		InputSHA256: map[string]string{"models_capture": strings.Repeat("1", 64), "agent_suite": strings.Repeat("2", 64), "agent_observations": strings.Repeat("3", 64), "agent_report": strings.Repeat("4", 64)},
		Checks:      checks, Disclaimer: "fixture retains release approval boundary",
	}
}