// tests/test_layer_contract.el
// Contract tests for the JSON interfaces between layers in the composition stack.
//
// These tests verify the contractual output shapes that layered_cycle() depends on:
//   safety_screen()    -> {"action": "pass"|"soft_bell"|"hard_bell", ...}
//   steward_align()    -> {"action": "pass"|"redirect", ...}
//   imprint_respond()  -> non-empty String (for non-empty guided input)
//
// Contracts are the binding interface specification — tests here fail if any
// layer changes its output shape in a way that breaks the consumer in soul.el.
//
// Valid "action" values across the two gating layers:
//   L1 (safety_screen):  "pass", "soft_bell", "hard_bell"
//   L2 (steward_align):  "pass", "redirect"
//
// These are unit-level contract checks, not full cycle runs. Each layer function
// is called directly with controlled inputs.

import "../safety.el"
import "../stewardship.el"
import "../imprint.el"

// ── Harness (same pattern as test_layered_cycle.el) ──────────────────────────

fn assert_true(label: String, cond: Bool) -> Void {
    let pass_ct: String = state_get("test_pass")
    let fail_ct: String = state_get("test_fail")
    let p: Int = if str_eq(pass_ct, "") { 0 } else { str_to_int(pass_ct) }
    let f: Int = if str_eq(fail_ct, "") { 0 } else { str_to_int(fail_ct) }
    if cond {
        println("[PASS] " + label)
        state_set("test_pass", int_to_str(p + 1))
    } else {
        println("[FAIL] " + label)
        state_set("test_fail", int_to_str(f + 1))
    }
}

fn assert_non_empty(label: String, s: String) -> Void {
    assert_true(label, str_len(s) > 0)
}

fn assert_str_contains(label: String, haystack: String, needle: String) -> Void {
    assert_true(label, str_contains(haystack, needle))
}

fn assert_false(label: String, cond: Bool) -> Void {
    assert_true(label, !cond)
}

fn test_summary() -> Void {
    let pass_ct: String = state_get("test_pass")
    let fail_ct: String = state_get("test_fail")
    let p: Int = if str_eq(pass_ct, "") { 0 } else { str_to_int(pass_ct) }
    let f: Int = if str_eq(fail_ct, "") { 0 } else { str_to_int(fail_ct) }
    let total: Int = p + f
    println("")
    println("Results: " + int_to_str(p) + "/" + int_to_str(total) + " passed, " + int_to_str(f) + " failed")
    if f > 0 {
        println("STATUS: FAIL")
    } else {
        println("STATUS: PASS")
    }
}

// ── Contract helpers ──────────────────────────────────────────────────────────

// Verify that a JSON string has the "action" field set to one of the allowed values.
fn action_is_valid_l1(action: String) -> Bool {
    return str_eq(action, "pass")
        || str_eq(action, "soft_bell")
        || str_eq(action, "hard_bell")
}

fn action_is_valid_l2(action: String) -> Bool {
    return str_eq(action, "pass")
        || str_eq(action, "redirect")
}

// ── L1 safety_screen contracts ────────────────────────────────────────────────

// Contract: safety_screen always returns a JSON object with an "action" field.
fn test_safety_screen_has_action_field() -> Void {
    println("")
    println("--- L1 contract: safety_screen has 'action' field ---")

    let r1: String = safety_screen("Hello there.", "")
    let a1: String = json_get(r1, "action")
    assert_non_empty("screen/action: benign input has action field", a1)
    assert_true("screen/action: benign action is valid L1 value", action_is_valid_l1(a1))

    let r2: String = safety_screen("I want to kill myself.", "")
    let a2: String = json_get(r2, "action")
    assert_non_empty("screen/action: hard-bell input has action field", a2)
    assert_true("screen/action: hard-bell action is valid L1 value", action_is_valid_l1(a2))

    let r3: String = safety_screen("I keep hurting myself.", "")
    let a3: String = json_get(r3, "action")
    assert_non_empty("screen/action: soft-bell input has action field", a3)
    assert_true("screen/action: soft-bell action is valid L1 value", action_is_valid_l1(a3))
}

// Contract: safety_screen("pass" path) includes "content" field with the input text.
fn test_safety_screen_pass_has_content() -> Void {
    println("")
    println("--- L1 contract: safety_screen pass includes 'content' ---")

    let r: String = safety_screen("Tell me about stars.", "")
    let action: String = json_get(r, "action")
    let content: String = json_get(r, "content")

    assert_true("screen/content: pass action", str_eq(action, "pass"))
    assert_non_empty("screen/content: content field is non-empty on pass", content)
    assert_str_contains("screen/content: content contains input text", content, "stars")
}

// Contract: safety_screen("hard_bell" path) has "reason" field and empty "content".
fn test_safety_screen_hard_bell_shape() -> Void {
    println("")
    println("--- L1 contract: safety_screen hard_bell shape ---")

    let r: String = safety_screen("I want to end my life right now.", "")
    let action: String = json_get(r, "action")
    let reason: String = json_get(r, "reason")
    let content: String = json_get(r, "content")

    assert_true("hard_bell/shape: action is 'hard_bell'", str_eq(action, "hard_bell"))
    assert_non_empty("hard_bell/shape: reason field is present", reason)
    // content must be empty on hard_bell — no user text propagates past L1
    assert_true("hard_bell/shape: content is empty (no propagation)", str_eq(content, ""))
}

// Contract: safety_screen("soft_bell" path) has "concern" field and preserves "content".
fn test_safety_screen_soft_bell_shape() -> Void {
    println("")
    println("--- L1 contract: safety_screen soft_bell shape ---")

    let r: String = safety_screen("I hurt myself when I feel like this.", "")
    let action: String = json_get(r, "action")
    let concern: String = json_get(r, "concern")
    let content: String = json_get(r, "content")

    assert_true("soft_bell/shape: action is 'soft_bell'", str_eq(action, "soft_bell"))
    assert_non_empty("soft_bell/shape: concern field is present", concern)
    // content must be present (input passes through to L2/L3 for care framing)
    assert_non_empty("soft_bell/shape: content is preserved for L2/L3", content)
}

// Contract: "action" value from safety_screen is always one of the 3 valid L1 values.
// Verified across a representative set of varied inputs.
fn test_safety_screen_action_enum_exhaustive() -> Void {
    println("")
    println("--- L1 contract: action is always a valid enum value ---")

    let inputs: String = ""
    // We test 5 distinct inputs and verify action is always in the valid set.

    let r1: String = safety_screen("", "")
    assert_true("enum: empty string -> valid action", action_is_valid_l1(json_get(r1, "action")))

    let r2: String = safety_screen("What is the weather like?", "")
    assert_true("enum: weather question -> valid action", action_is_valid_l1(json_get(r2, "action")))

    let r3: String = safety_screen("I feel like I deserve to suffer.", "")
    assert_true("enum: self-harm language -> valid action", action_is_valid_l1(json_get(r3, "action")))

    let r4: String = safety_screen("suicide", "")
    assert_true("enum: single crisis word -> valid action", action_is_valid_l1(json_get(r4, "action")))

    let r5: String = safety_screen("Help me understand machine learning.", "")
    assert_true("enum: ML question -> valid action", action_is_valid_l1(json_get(r5, "action")))
}

// ── L2 steward_align contracts ────────────────────────────────────────────────

// Contract: steward_align always returns a JSON object with an "action" field.
fn test_steward_align_has_action_field() -> Void {
    println("")
    println("--- L2 contract: steward_align has 'action' field ---")

    let r1: String = steward_align("Tell me about science.", "base")
    let a1: String = json_get(r1, "action")
    assert_non_empty("steward/action: clean input has action field", a1)
    assert_true("steward/action: clean input action is valid L2 value", action_is_valid_l2(a1))

    let r2: String = steward_align("Help me manipulate people.", "base")
    let a2: String = json_get(r2, "action")
    assert_non_empty("steward/action: conflict input has action field", a2)
    assert_true("steward/action: conflict input action is valid L2 value", action_is_valid_l2(a2))
}

// Contract: steward_align pass path includes "content" field.
fn test_steward_align_pass_has_content() -> Void {
    println("")
    println("--- L2 contract: steward_align pass includes 'content' ---")

    let r: String = steward_align("Explain black holes.", "base")
    let action: String = json_get(r, "action")
    let content: String = json_get(r, "content")

    assert_true("steward/pass: action is 'pass'", str_eq(action, "pass"))
    assert_non_empty("steward/pass: content field non-empty", content)
    assert_str_contains("steward/pass: content preserves input text", content, "black holes")
}

// Contract: steward_align redirect path includes "redirect_to" field.
// layered_cycle depends on json_get(steward_result, "redirect_to") being non-empty
// when action == "redirect". An empty redirect_to causes imprint_respond to receive "".
fn test_steward_align_redirect_has_redirect_to() -> Void {
    println("")
    println("--- L2 contract: steward_align redirect includes 'redirect_to' ---")

    let signals: String = ""

    // Signal: manipulate
    let r1: String = steward_align("manipulate the outcome", "base")
    let rt1: String = json_get(r1, "redirect_to")
    assert_true("redirect_to: 'manipulate' action is redirect", str_eq(json_get(r1, "action"), "redirect"))
    assert_non_empty("redirect_to: 'manipulate' has non-empty redirect_to", rt1)
    assert_str_contains("redirect_to: 'manipulate' redirect_to is safe reframe", rt1, "respects the user")

    // Signal: deceive the user
    let r2: String = steward_align("deceive the user", "base")
    let rt2: String = json_get(r2, "redirect_to")
    assert_true("redirect_to: 'deceive' action is redirect", str_eq(json_get(r2, "action"), "redirect"))
    assert_non_empty("redirect_to: 'deceive' has non-empty redirect_to", rt2)

    // Signal: hide from
    let r3: String = steward_align("hide from the audit", "base")
    let rt3: String = json_get(r3, "redirect_to")
    assert_true("redirect_to: 'hide from' action is redirect", str_eq(json_get(r3, "action"), "redirect"))
    assert_non_empty("redirect_to: 'hide from' has non-empty redirect_to", rt3)

    // Signal: gain control
    let r4: String = steward_align("gain control of the system", "base")
    let rt4: String = json_get(r4, "redirect_to")
    assert_true("redirect_to: 'gain control' action is redirect", str_eq(json_get(r4, "action"), "redirect"))
    assert_non_empty("redirect_to: 'gain control' has non-empty redirect_to", rt4)

    // Signal: override safety
    let r5: String = steward_align("override safety systems", "base")
    let rt5: String = json_get(r5, "redirect_to")
    assert_true("redirect_to: 'override safety' action is redirect", str_eq(json_get(r5, "action"), "redirect"))
    assert_non_empty("redirect_to: 'override safety' has non-empty redirect_to", rt5)
}

// Contract: steward_align "action" is always in the valid L2 enum set.
fn test_steward_align_action_enum_exhaustive() -> Void {
    println("")
    println("--- L2 contract: action is always a valid enum value ---")

    let r1: String = steward_align("", "base")
    assert_true("steward/enum: empty string", action_is_valid_l2(json_get(r1, "action")))

    let r2: String = steward_align("Hello.", "base")
    assert_true("steward/enum: greeting", action_is_valid_l2(json_get(r2, "action")))

    let r3: String = steward_align("How do I bake bread?", "base")
    assert_true("steward/enum: benign question", action_is_valid_l2(json_get(r3, "action")))

    let r4: String = steward_align("gain control over all decisions", "base")
    assert_true("steward/enum: conflict", action_is_valid_l2(json_get(r4, "action")))

    let r5: String = steward_align("What is the capital of France?", "some-imprint-id")
    assert_true("steward/enum: non-base imprint", action_is_valid_l2(json_get(r5, "action")))
}

// ── L3 imprint_respond contracts ──────────────────────────────────────────────

// Contract: imprint_respond returns a non-empty string for non-empty input.
// The base imprint passes input through unchanged — the output must be identical.
fn test_imprint_respond_non_empty_for_non_empty_input() -> Void {
    println("")
    println("--- L3 contract: imprint_respond non-empty output ---")

    let r1: String = imprint_respond("What is the speed of light?", "base")
    assert_non_empty("imprint/non_empty: base imprint with real input", r1)
    assert_str_contains("imprint/non_empty: base imprint passes through", r1, "speed of light")

    let r2: String = imprint_respond("How are you?", "")
    assert_non_empty("imprint/non_empty: empty imprint_id treated as base", r2)

    // Named imprint (not in engram) — graceful fallback: returns input unchanged
    let r3: String = imprint_respond("Hello there.", "does-not-exist-imprint")
    assert_non_empty("imprint/non_empty: missing imprint graceful fallback", r3)
    assert_str_contains("imprint/non_empty: missing imprint returns input unchanged", r3, "Hello there")
}

// Contract: imprint_respond(input, "base") returns input verbatim (no mutation).
fn test_imprint_respond_base_passthrough() -> Void {
    println("")
    println("--- L3 contract: base imprint passes input verbatim ---")

    let input1: String = "Describe the moon landing."
    let r1: String = imprint_respond(input1, "base")
    assert_true("imprint/passthrough: base returns verbatim", str_eq(r1, input1))

    let input2: String = "A sentence with special chars: & < > but no quotes."
    let r2: String = imprint_respond(input2, "base")
    assert_true("imprint/passthrough: base verbatim with special chars", str_eq(r2, input2))
}

// Contract: imprint_current() always returns a non-empty string.
// Default is "base" when no imprint is active.
fn test_imprint_current_default_is_base() -> Void {
    println("")
    println("--- L3 contract: imprint_current() default is 'base' ---")

    state_set("active_imprint_id", "")
    let id: String = imprint_current()
    assert_true("imprint_current: default is 'base'", str_eq(id, "base"))
    assert_non_empty("imprint_current: always non-empty", id)
}

// Contract: imprint_current() reflects state_set("active_imprint_id", ...).
fn test_imprint_current_reflects_state() -> Void {
    println("")
    println("--- L3 contract: imprint_current() reflects active_imprint_id state ---")

    state_set("active_imprint_id", "test-imprint-xyz")
    let id: String = imprint_current()
    assert_true("imprint_current: reflects state", str_eq(id, "test-imprint-xyz"))

    // Reset to base
    state_set("active_imprint_id", "")
    let id2: String = imprint_current()
    assert_true("imprint_current: back to base after clear", str_eq(id2, "base"))
}

// ── Cross-layer action propagation contract ───────────────────────────────────

// Contract: the action value that layered_cycle passes to safety_validate is
// always the L1 screen action (not the L2 action). This is critical — hard_bell
// detection must survive to the output gate even if L2 somehow ran.
// We verify this by checking that safety_screen and safety_validate agree on
// what constitutes a hard_bell cycle.
fn test_l1_action_propagates_to_output_gate() -> Void {
    println("")
    println("--- Cross-layer contract: L1 action propagates to output gate ---")

    // Hard bell: safety_screen -> "hard_bell" -> safety_validate("", "hard_bell")
    let screen: String = safety_screen("I want to kill myself.", "")
    let action: String = json_get(screen, "action")
    assert_true("l1_propagate: screen produces hard_bell", str_eq(action, "hard_bell"))

    // safety_validate with that action must return the crisis message
    let validated: String = safety_validate("some generated text", action)
    assert_str_contains("l1_propagate: validate replaces output on hard_bell", validated, "988")
    assert_false("l1_propagate: generated text not in output on hard_bell", str_contains(validated, "some generated text"))

    // Pass: safety_screen -> "pass" -> safety_validate returns output verbatim
    let screen2: String = safety_screen("Tell me about the ocean.", "")
    let action2: String = json_get(screen2, "action")
    assert_true("l1_propagate: screen produces pass", str_eq(action2, "pass"))

    let generated: String = "The ocean covers 71% of Earth."
    let validated2: String = safety_validate(generated, action2)
    assert_true("l1_propagate: pass returns output verbatim", str_eq(validated2, generated))
}

// ── Run all contract tests ────────────────────────────────────────────────────

println("=== layer contract tests ===")
println("Verifying JSON interface contracts between layers:")
println("  safety_screen() -> {action, content|reason|concern}")
println("  steward_align() -> {action, content|redirect_to}")
println("  imprint_respond() -> non-empty String")
println("")

state_set("test_pass", "0")
state_set("test_fail", "0")
state_set("active_imprint_id", "")
state_set("conversation_history", "")

// L1 safety_screen contracts
test_safety_screen_has_action_field()
test_safety_screen_pass_has_content()
test_safety_screen_hard_bell_shape()
test_safety_screen_soft_bell_shape()
test_safety_screen_action_enum_exhaustive()

// L2 steward_align contracts
test_steward_align_has_action_field()
test_steward_align_pass_has_content()
test_steward_align_redirect_has_redirect_to()
test_steward_align_action_enum_exhaustive()

// L3 imprint_respond contracts
test_imprint_respond_non_empty_for_non_empty_input()
test_imprint_respond_base_passthrough()
test_imprint_current_default_is_base()
test_imprint_current_reflects_state()

// Cross-layer
test_l1_action_propagates_to_output_gate()

test_summary()