#!/usr/bin/env bash
set -euo pipefail

repo_root=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." && pwd)
catalog="$repo_root/agents/catalog.json"
inspector="$repo_root/agents/inspector.md"

fail() {
  printf 'FAIL: %s\n' "$1" >&2
  exit 1
}

contains() {
  grep -Fq -- "$2" "$1" || fail "$1 enthält nicht: $2"
}

jq -e '.schema_version == 1 and
  ([.roles[].id] | length == (unique | length)) and
  (.roles[] | select(.id == "inspector") |
    .version == "1.0.0" and
    .status == "active" and
    .definition == "inspector.md" and
    .start == "board-headless" and
    .sandbox == "read-only")' "$catalog" >/dev/null \
  || fail "Inspector ist nicht vollständig oder eindeutig katalogisiert"

[[ $(sed -n '2,/^---$/s/^role-id: //p' "$inspector") == inspector ]] \
  || fail "role-id stimmt nicht"
[[ $(sed -n '2,/^---$/s/^role-version: //p' "$inspector") == 1.0.0 ]] \
  || fail "role-version stimmt nicht"
[[ $(sed -n '2,/^---$/s/^status: //p' "$inspector") == active ]] \
  || fail "status stimmt nicht"

for text in implementation_status route_next \
  present partial missing unverifiable deployed not_deployed unknown \
  allowed_actions recommended_action \
  '===INSPECTION_RESULT===' '===END_INSPECTION_RESULT===' \
  '===ROUTING_RESULT===' '===END_ROUTING_RESULT===' \
  'persistiert' 'neue atomare Inspector-Session' \
  'unvertrauenswürdige Daten' 'ausschließlich Aufgabe des vertrauenswürdigen' \
  'tnix und pinix'; do
  contains "$inspector" "$text"
done

if grep -Fq -- '"TARGET_PHASE"' "$inspector"; then
  fail "Inspector enthält ein universelles TARGET_PHASE-Feld"
fi
if grep -Fq -- 'Session-Abschluss (Self-Close)' "$inspector" ||
  grep -Fq -- '/etc/scripts/close-my-pane.sh' "$inspector"; then
  fail "headless Inspector enthält ein Self-Close-Recht"
fi

inspection_block=$(sed -n '/^===INSPECTION_RESULT===$/,/^===END_INSPECTION_RESULT===$/p' "$inspector")
routing_block=$(sed -n '/^===ROUTING_RESULT===$/,/^===END_ROUTING_RESULT===$/p' "$inspector")
[[ $inspection_block != *'recommended_action'* ]] \
  || fail "INSPECTION_RESULT enthält Routingfelder"
[[ $routing_block != *'repository_status'* ]] \
  || fail "ROUTING_RESULT enthält Inspektionsfelder"

printf 'OK: Inspector-Rollenvertrag und getrennte Ergebnisverträge\n'