"""
AI Agent professional task expansion and Telegram runtime bridge snapshot.

Loads the latest committed P2-405F read-only contract. The contract expands
professional AI Agent work and defines Telegram no-send previews plus canary
delivery rehearsal and owner review gate evidence, but it does not write
Telegram Gateway queues, send Telegram messages, call the Bot API, read secrets,
or execute production changes.
"""

from __future__ import annotations

import copy
import json
from pathlib import Path
from typing import Any

from src.services.snapshot_paths import default_evaluations_dir

_DEFAULT_EVALUATIONS_DIR = default_evaluations_dir(Path(__file__))
_SNAPSHOT_PATTERN = "ai_agent_professional_task_expansion_*.json"
_SCHEMA_VERSION = "ai_agent_professional_task_expansion_v1"
_RUNTIME_AUTHORITY = "professional_task_expansion_and_telegram_bridge_read_only_no_send"
_EXPECTED_TASK_COUNT = 24
_EXPECTED_DOMAIN_COUNT = 8
_EXPECTED_STAGE_COUNT = 5
_EXPECTED_MESSAGE_TYPE_COUNT = 6
_EXPECTED_NO_SEND_PREVIEW_COUNT = 6
_EXPECTED_DEDUP_KEY_COUNT = 6
_EXPECTED_RECEIPT_EXPECTATION_COUNT = 6
_EXPECTED_CANARY_PACKAGE_COUNT = 1
_EXPECTED_CANARY_APPROVAL_PACKET_COUNT = 1
_EXPECTED_CANARY_DELIVERY_GATE_COUNT = 1
_EXPECTED_CANARY_DELIVERY_REHEARSAL_COUNT = 1
_EXPECTED_CANARY_LIVE_DELIVERY_OWNER_REVIEW_GATE_COUNT = 1
_ZERO_ROLLUP_FIELDS = {
    "current_live_count",
    "gateway_queue_write_count",
    "telegram_send_count",
    "bot_api_call_count",
    "delivery_receipt_write_count",
    "production_write_count",
    "secret_read_count",
    "paid_api_call_count",
    "host_write_count",
    "kubectl_action_count",
    "preview_send_enabled_count",
    "preview_queue_write_enabled_count",
    "preview_bot_api_call_enabled_count",
    "receipt_live_write_enabled_count",
    "canary_live_send_enabled_count",
    "canary_approval_granted_count",
    "canary_selected_message_type_count",
    "canary_approved_time_window_count",
    "canary_send_execution_enabled_count",
    "canary_gateway_queue_write_enabled_count",
    "canary_bot_api_call_enabled_count",
    "canary_delivery_receipt_write_enabled_count",
    "canary_secret_read_enabled_count",
    "canary_delivery_approved_count",
    "canary_delivery_attempt_allowed_count",
    "canary_delivery_live_send_enabled_count",
    "canary_delivery_gateway_queue_write_enabled_count",
    "canary_delivery_bot_api_call_enabled_count",
    "canary_delivery_receipt_write_enabled_count",
    "canary_delivery_secret_read_enabled_count",
    "canary_delivery_paid_api_enabled_count",
    "canary_delivery_rehearsal_live_send_enabled_count",
    "canary_delivery_rehearsal_gateway_queue_write_enabled_count",
    "canary_delivery_rehearsal_bot_api_call_enabled_count",
    "canary_delivery_rehearsal_receipt_write_enabled_count",
    "canary_live_delivery_owner_review_received_count",
    "canary_live_delivery_owner_review_accepted_count",
    "canary_live_delivery_approved_count",
    "canary_live_delivery_attempt_allowed_count",
    "canary_live_delivery_gateway_queue_write_enabled_count",
    "canary_live_delivery_bot_api_call_enabled_count",
    "canary_live_delivery_telegram_send_enabled_count",
    "canary_live_delivery_receipt_write_enabled_count",
}
_FORBIDDEN_PUBLIC_TERMS = {
    "工作視窗內容",
    "工作視窗對話",
    "work_window_transcript",
    "raw prompt",
    "private reasoning",
    "chain-of-thought",
    "telegram token",
    "authorization header",
    "secret value",
}


def load_latest_ai_agent_professional_task_expansion(
    evaluations_dir: Path | None = None,
) -> dict[str, Any]:
    """Load the newest committed AI Agent professional task expansion snapshot."""
    directory = evaluations_dir or _DEFAULT_EVALUATIONS_DIR
    candidates = sorted(directory.glob(_SNAPSHOT_PATTERN))
    if not candidates:
        raise FileNotFoundError(
            f"no AI Agent professional task expansion snapshots found in {directory}"
        )

    latest = candidates[-1]
    with latest.open(encoding="utf-8") as handle:
        payload = json.load(handle)

    if not isinstance(payload, dict):
        raise ValueError(f"{latest}: expected JSON object")

    label = str(latest)
    _require_schema(payload, label)
    _require_telegram_bridge(payload, label)
    _require_professional_tasks(payload, label)
    _require_reporting_and_redaction(payload, label)
    _require_rollups(payload, label)
    _require_no_forbidden_public_terms(payload, label)
    return payload


def _require_schema(payload: dict[str, Any], label: str) -> None:
    if payload.get("schema_version") != _SCHEMA_VERSION:
        raise ValueError(f"{label}: expected schema_version={_SCHEMA_VERSION}")

    status = payload.get("program_status") or {}
    expected = {
        "current_priority": "P2",
        "current_task_id": "P2-405F",
        "next_task_id": "P2-406B",
        "read_only_mode": True,
        "runtime_authority": _RUNTIME_AUTHORITY,
        "overall_completion_percent": 99,
    }
    mismatches = _mismatches(status, expected)
    if mismatches:
        raise ValueError(f"{label}: program_status mismatch: {mismatches}")
    if not status.get("status_note"):
        raise ValueError(f"{label}: program_status.status_note is required")


def _require_telegram_bridge(payload: dict[str, Any], label: str) -> None:
    bridge = payload.get("telegram_runtime_bridge") or {}
    expected = {
        "canonical_room": "AwoooI SRE 戰情室",
        "canonical_room_env": "SRE_GROUP_CHAT_ID",
        "gateway_required": True,
        "no_send_preview_ready": True,
        "queue_preview_readback_ready": True,
        "approved_canary_required": True,
        "direct_bot_api_allowed": False,
        "bot_api_call_enabled": False,
        "gateway_queue_write_enabled": False,
        "telegram_send_enabled": False,
        "delivery_receipt_write_enabled": False,
    }
    mismatches = _mismatches(bridge, expected)
    if mismatches:
        raise ValueError(f"{label}: telegram_runtime_bridge mismatch: {mismatches}")

    stages = bridge.get("stages") or []
    if len(stages) != _EXPECTED_STAGE_COUNT:
        raise ValueError(f"{label}: expected {_EXPECTED_STAGE_COUNT} Telegram stages")
    if any(stage.get("live_send_enabled") is not False for stage in stages):
        raise ValueError(f"{label}: Telegram stages must keep live_send_enabled false")

    message_types = bridge.get("message_types") or []
    if len(message_types) != _EXPECTED_MESSAGE_TYPE_COUNT:
        raise ValueError(f"{label}: expected {_EXPECTED_MESSAGE_TYPE_COUNT} message types")

    _require_no_send_previews(bridge, label)
    _require_receipt_and_canary_package(bridge, label)
    _require_canary_send_approval_packet(bridge, label)
    _require_canary_delivery_gate(bridge, label)
    _require_canary_delivery_rehearsal(bridge, label)
    _require_canary_live_delivery_owner_review_gate(bridge, label)


def _require_no_send_previews(bridge: dict[str, Any], label: str) -> None:
    previews = bridge.get("no_send_message_previews") or []
    if len(previews) != _EXPECTED_NO_SEND_PREVIEW_COUNT:
        raise ValueError(f"{label}: expected {_EXPECTED_NO_SEND_PREVIEW_COUNT} no-send previews")

    message_types = {item.get("message_type") for item in bridge.get("message_types") or []}
    preview_message_types = [preview.get("message_type") for preview in previews]
    if set(preview_message_types) != message_types:
        raise ValueError(f"{label}: no-send previews must cover every message type exactly once")

    dedup_keys = [preview.get("dedup_key") for preview in previews]
    if len(set(dedup_keys)) != len(dedup_keys):
        raise ValueError(f"{label}: no-send preview dedup_key values must be unique")

    for preview in previews:
        preview_id = preview.get("preview_id")
        if preview.get("status") != "preview_ready_no_send":
            raise ValueError(f"{label}: {preview_id}.status must be preview_ready_no_send")
        if preview.get("send_enabled") is not False:
            raise ValueError(f"{label}: {preview_id}.send_enabled must remain false")
        if preview.get("gateway_queue_write_enabled") is not False:
            raise ValueError(f"{label}: {preview_id}.gateway_queue_write_enabled must remain false")
        if preview.get("bot_api_call_enabled") is not False:
            raise ValueError(f"{label}: {preview_id}.bot_api_call_enabled must remain false")
        if preview.get("delivery_receipt_write_enabled") is not False:
            raise ValueError(f"{label}: {preview_id}.delivery_receipt_write_enabled must remain false")
        if not preview.get("sanitized_body_lines"):
            raise ValueError(f"{label}: {preview_id}.sanitized_body_lines must not be empty")

    dedup_policy = bridge.get("dedup_policy") or {}
    keys = dedup_policy.get("keys") or []
    if dedup_policy.get("required") is not True:
        raise ValueError(f"{label}: dedup_policy.required must be true")
    if dedup_policy.get("live_cache_write_enabled") is not False:
        raise ValueError(f"{label}: dedup_policy.live_cache_write_enabled must remain false")
    if len(keys) != _EXPECTED_DEDUP_KEY_COUNT:
        raise ValueError(f"{label}: expected {_EXPECTED_DEDUP_KEY_COUNT} dedup keys")

    queue_preview = bridge.get("queue_preview_readback") or {}
    expected_queue = {
        "enabled": True,
        "preview_only": True,
        "write_enabled": False,
        "readback_enabled": True,
    }
    mismatches = _mismatches(queue_preview, expected_queue)
    if mismatches:
        raise ValueError(f"{label}: queue_preview_readback mismatch: {mismatches}")


def _require_receipt_and_canary_package(bridge: dict[str, Any], label: str) -> None:
    previews = bridge.get("no_send_message_previews") or []
    preview_ids = {preview.get("preview_id") for preview in previews}
    preview_receipts = {preview.get("receipt_expectation_id") for preview in previews}

    receipts = bridge.get("receipt_expectations") or []
    if len(receipts) != _EXPECTED_RECEIPT_EXPECTATION_COUNT:
        raise ValueError(f"{label}: expected {_EXPECTED_RECEIPT_EXPECTATION_COUNT} receipt expectations")

    receipt_ids = {receipt.get("receipt_id") for receipt in receipts}
    if receipt_ids != preview_receipts:
        raise ValueError(f"{label}: receipt expectations must match preview receipt ids")

    for receipt in receipts:
        receipt_id = receipt.get("receipt_id")
        if receipt.get("preview_id") not in preview_ids:
            raise ValueError(f"{label}: {receipt_id}.preview_id must reference a no-send preview")
        if receipt.get("receipt_write_enabled") is not False:
            raise ValueError(f"{label}: {receipt_id}.receipt_write_enabled must remain false")
        if receipt.get("production_receipt_readback_enabled") is not False:
            raise ValueError(
                f"{label}: {receipt_id}.production_receipt_readback_enabled must remain false"
            )
        if not receipt.get("required_evidence_refs"):
            raise ValueError(f"{label}: {receipt_id}.required_evidence_refs must not be empty")

    canary = bridge.get("canary_approval_package") or {}
    expected_canary = {
        "package_ready": True,
        "approval_required": True,
        "status": "blocked_until_explicit_approval",
        "live_send_enabled": False,
        "gateway_queue_write_enabled": False,
        "bot_api_call_enabled": False,
        "delivery_receipt_write_enabled": False,
        "production_write_enabled": False,
    }
    mismatches = _mismatches(canary, expected_canary)
    if mismatches:
        raise ValueError(f"{label}: canary_approval_package mismatch: {mismatches}")
    if not canary:
        raise ValueError(f"{label}: expected {_EXPECTED_CANARY_PACKAGE_COUNT} canary package")
    if not canary.get("approval_checklist"):
        raise ValueError(f"{label}: canary_approval_package.approval_checklist is required")


def _require_canary_send_approval_packet(bridge: dict[str, Any], label: str) -> None:
    packet = bridge.get("canary_send_approval_packet") or {}
    expected_packet = {
        "packet_ready": True,
        "approval_required": True,
        "approval_granted": False,
        "status": "waiting_explicit_commander_approval",
        "target_room_env": "SRE_GROUP_CHAT_ID",
        "target_room_value_visible": False,
        "selected_message_type": "not_selected",
        "proposed_time_window": "waiting_commander_input",
    }
    mismatches = _mismatches(packet, expected_packet)
    if mismatches:
        raise ValueError(f"{label}: canary_send_approval_packet mismatch: {mismatches}")
    if not packet:
        raise ValueError(
            f"{label}: expected {_EXPECTED_CANARY_APPROVAL_PACKET_COUNT} canary send approval packet"
        )

    message_types = {item.get("message_type") for item in bridge.get("message_types") or []}
    eligible = set(packet.get("eligible_message_types") or [])
    if eligible != message_types:
        raise ValueError(f"{label}: canary send packet must cover every eligible message type")

    fields = packet.get("operator_approval_fields") or []
    required_field_ids = {
        "commander_approval",
        "selected_message_type",
        "scheduled_window",
        "target_room_env_ref",
        "mute_rollback_plan",
        "receipt_readback_owner",
        "failure_stop_condition",
    }
    field_ids = {field.get("field_id") for field in fields}
    if field_ids != required_field_ids:
        raise ValueError(f"{label}: canary send packet approval fields mismatch")
    for field in fields:
        field_id = field.get("field_id")
        if field.get("required") is not True:
            raise ValueError(f"{label}: {field_id}.required must be true")
        if field.get("current_value_status") != "waiting_input":
            raise ValueError(f"{label}: {field_id}.current_value_status must be waiting_input")
        if field.get("value_display_allowed") is not False:
            raise ValueError(f"{label}: {field_id}.value_display_allowed must remain false")

    execution_flags = packet.get("execution_flags") or {}
    expected_execution = {
        "canary_send_execution_enabled": False,
        "gateway_queue_write_enabled": False,
        "bot_api_call_enabled": False,
        "delivery_receipt_write_enabled": False,
        "production_write_enabled": False,
        "secret_read_enabled": False,
        "paid_api_enabled": False,
    }
    mismatches = _mismatches(execution_flags, expected_execution)
    if mismatches:
        raise ValueError(f"{label}: canary send execution flags mismatch: {mismatches}")

    rate_limit = packet.get("rate_limit_plan") or {}
    if rate_limit.get("max_messages") != 1:
        raise ValueError(f"{label}: canary send max_messages must be 1")
    if rate_limit.get("live_rate_limit_write_enabled") is not False:
        raise ValueError(f"{label}: live_rate_limit_write_enabled must remain false")

    receipt_plan = packet.get("receipt_readback_plan") or {}
    if receipt_plan.get("production_receipt_write_enabled") is not False:
        raise ValueError(f"{label}: production_receipt_write_enabled must remain false")
    if receipt_plan.get("receipt_readback_enabled_before_send") is not False:
        raise ValueError(f"{label}: receipt_readback_enabled_before_send must remain false")
    if not receipt_plan.get("required_checks"):
        raise ValueError(f"{label}: receipt_readback_plan.required_checks is required")
    if not packet.get("stop_conditions"):
        raise ValueError(f"{label}: canary send packet stop_conditions are required")
    if not packet.get("mute_rollback_plan"):
        raise ValueError(f"{label}: canary send packet mute_rollback_plan is required")
    if packet.get("approval_decision_log") != []:
        raise ValueError(f"{label}: canary send approval_decision_log must remain empty")


def _require_canary_delivery_gate(bridge: dict[str, Any], label: str) -> None:
    gate = bridge.get("canary_delivery_gate") or {}
    expected_gate = {
        "status": "blocked_waiting_commander_delivery_fields",
        "gate_ready": True,
        "delivery_approved": False,
        "delivery_attempt_allowed": False,
        "selected_message_type": "not_selected",
        "target_room_env": "SRE_GROUP_CHAT_ID",
        "target_room_value_visible": False,
        "target_room_verified": False,
        "proposed_time_window": "waiting_commander_input",
        "approved_time_window": "not_approved",
    }
    mismatches = _mismatches(gate, expected_gate)
    if mismatches:
        raise ValueError(f"{label}: canary_delivery_gate mismatch: {mismatches}")
    if not gate:
        raise ValueError(
            f"{label}: expected {_EXPECTED_CANARY_DELIVERY_GATE_COUNT} canary delivery gate"
        )

    fields = gate.get("required_delivery_fields") or []
    required_field_ids = {
        "commander_delivery_approval",
        "selected_message_type",
        "delivery_time_window",
        "target_room_env_ref",
        "receipt_readback_owner",
        "mute_rollback_plan",
        "failure_stop_condition",
        "dry_run_readback_ref",
    }
    field_ids = {field.get("field_id") for field in fields}
    if field_ids != required_field_ids:
        raise ValueError(f"{label}: canary delivery required fields mismatch")
    for field in fields:
        field_id = field.get("field_id")
        if field.get("required") is not True:
            raise ValueError(f"{label}: {field_id}.required must be true")
        if field.get("current_value_status") != "waiting_input":
            raise ValueError(f"{label}: {field_id}.current_value_status must be waiting_input")
        if field.get("value_display_allowed") is not False:
            raise ValueError(f"{label}: {field_id}.value_display_allowed must remain false")

    attempt_plan = gate.get("delivery_attempt_plan") or {}
    expected_attempt = {
        "max_messages": 1,
        "send_mode": "blocked_no_send",
        "live_delivery_enabled": False,
        "gateway_queue_write_enabled": False,
        "bot_api_call_enabled": False,
        "delivery_receipt_write_enabled": False,
        "production_write_enabled": False,
        "secret_read_enabled": False,
        "paid_api_enabled": False,
    }
    mismatches = _mismatches(attempt_plan, expected_attempt)
    if mismatches:
        raise ValueError(f"{label}: canary delivery attempt plan mismatch: {mismatches}")

    execution_flags = gate.get("execution_flags") or {}
    expected_execution = {
        "live_delivery_enabled": False,
        "gateway_queue_write_enabled": False,
        "bot_api_call_enabled": False,
        "delivery_receipt_write_enabled": False,
        "production_write_enabled": False,
        "secret_read_enabled": False,
        "paid_api_enabled": False,
    }
    mismatches = _mismatches(execution_flags, expected_execution)
    if mismatches:
        raise ValueError(f"{label}: canary delivery execution flags mismatch: {mismatches}")

    readback_plan = gate.get("readback_after_approval_plan") or {}
    if readback_plan.get("enabled_before_delivery") is not False:
        raise ValueError(f"{label}: canary delivery readback must stay disabled before delivery")
    if readback_plan.get("production_receipt_write_enabled") is not False:
        raise ValueError(f"{label}: canary delivery production receipt write must remain false")
    if not readback_plan.get("required_checks"):
        raise ValueError(f"{label}: canary delivery readback required_checks are required")
    if not gate.get("preflight_checks"):
        raise ValueError(f"{label}: canary delivery preflight_checks are required")
    if not gate.get("hold_reasons"):
        raise ValueError(f"{label}: canary delivery hold_reasons are required")
    if not gate.get("rollback_mute_controls"):
        raise ValueError(f"{label}: canary delivery rollback_mute_controls are required")
    if gate.get("delivery_decision_log") != []:
        raise ValueError(f"{label}: canary delivery decision log must remain empty")


def _require_canary_delivery_rehearsal(bridge: dict[str, Any], label: str) -> None:
    rehearsal = bridge.get("canary_delivery_rehearsal") or {}
    expected = {
        "status": "ready_no_send_rehearsal",
        "rehearsal_ready": True,
        "selected_message_type": "daily_agent_workload_digest",
        "selected_preview_id": "p2_405b_preview_daily_agent_workload_digest_v1",
        "selected_receipt_expectation_id": "p2_405b_receipt_daily_agent_workload_digest_v1",
        "target_room_env": "SRE_GROUP_CHAT_ID",
        "target_room_value_visible": False,
        "preview_hash_algorithm": "sha256_preview_only",
    }
    mismatches = _mismatches(rehearsal, expected)
    if mismatches:
        raise ValueError(f"{label}: canary_delivery_rehearsal mismatch: {mismatches}")
    if not rehearsal:
        raise ValueError(
            f"{label}: expected {_EXPECTED_CANARY_DELIVERY_REHEARSAL_COUNT} "
            "canary delivery rehearsal"
        )

    envelope = rehearsal.get("gateway_envelope_preview") or {}
    expected_envelope = {
        "message_type": "daily_agent_workload_digest",
        "target_room_env_ref": "SRE_GROUP_CHAT_ID",
        "dedup_key": rehearsal.get("dedup_key"),
        "preview_hash": rehearsal.get("sanitized_preview_hash"),
        "risk_tier": "low",
        "queue_write_enabled": False,
        "bot_api_call_enabled": False,
        "telegram_send_enabled": False,
        "delivery_receipt_write_enabled": False,
    }
    mismatches = _mismatches(envelope, expected_envelope)
    if mismatches:
        raise ValueError(f"{label}: canary rehearsal envelope mismatch: {mismatches}")

    readback = rehearsal.get("readback_drill") or {}
    if readback.get("owner_agent") != "hermes":
        raise ValueError(f"{label}: canary rehearsal readback owner must be hermes")
    checks = readback.get("required_checks") or []
    if len(checks) != 8:
        raise ValueError(f"{label}: canary rehearsal must define 8 readback checks")
    if readback.get("completed_check_count") != len(checks):
        raise ValueError(f"{label}: canary rehearsal completed checks must match checks")
    if readback.get("failed_check_count") != 0:
        raise ValueError(f"{label}: canary rehearsal failed checks must remain zero")
    if readback.get("production_receipt_write_enabled") is not False:
        raise ValueError(f"{label}: canary rehearsal production receipt write must remain false")
    if readback.get("live_receipt_readback_enabled") is not False:
        raise ValueError(f"{label}: canary rehearsal live receipt readback must remain false")

    if len(rehearsal.get("dry_run_steps") or []) != 6:
        raise ValueError(f"{label}: canary rehearsal must define 6 dry-run steps")
    if len(rehearsal.get("stop_conditions") or []) != 7:
        raise ValueError(f"{label}: canary rehearsal must define 7 stop conditions")
    if len(rehearsal.get("rollback_mute_controls") or []) != 5:
        raise ValueError(f"{label}: canary rehearsal must define 5 rollback/mute controls")

    execution_flags = rehearsal.get("execution_flags") or {}
    expected_execution = {
        "live_delivery_enabled": False,
        "gateway_queue_write_enabled": False,
        "bot_api_call_enabled": False,
        "telegram_send_enabled": False,
        "delivery_receipt_write_enabled": False,
        "production_write_enabled": False,
        "secret_read_enabled": False,
        "paid_api_enabled": False,
    }
    mismatches = _mismatches(execution_flags, expected_execution)
    if mismatches:
        raise ValueError(f"{label}: canary rehearsal execution flags mismatch: {mismatches}")


def _require_canary_live_delivery_owner_review_gate(
    bridge: dict[str, Any], label: str
) -> None:
    gate = bridge.get("canary_live_delivery_owner_review_gate") or {}
    expected = {
        "status": "ready_for_owner_review_no_send",
        "gate_ready": True,
        "approval_required": True,
        "owner_review_received": False,
        "owner_review_accepted": False,
        "live_canary_delivery_approved": False,
        "delivery_attempt_allowed": False,
        "prior_rehearsal_status": "ready_no_send_rehearsal",
        "prior_readback_completed_check_count": 8,
        "prior_readback_failed_check_count": 0,
        "selected_message_type": "daily_agent_workload_digest",
        "selected_preview_id": "p2_405b_preview_daily_agent_workload_digest_v1",
        "selected_receipt_expectation_id": "p2_405b_receipt_daily_agent_workload_digest_v1",
        "target_room_env": "SRE_GROUP_CHAT_ID",
        "target_room_value_visible": False,
        "owner_agent": "telegram_ops_liaison",
        "receipt_readback_owner": "hermes",
        "arbiter": "openclaw",
    }
    mismatches = _mismatches(gate, expected)
    if mismatches:
        raise ValueError(
            f"{label}: canary_live_delivery_owner_review_gate mismatch: {mismatches}"
        )
    if not gate:
        raise ValueError(
            f"{label}: expected "
            f"{_EXPECTED_CANARY_LIVE_DELIVERY_OWNER_REVIEW_GATE_COUNT} "
            "canary live delivery owner review gate"
        )

    required_fields = gate.get("required_owner_fields") or []
    if len(required_fields) != 9:
        raise ValueError(f"{label}: canary live owner review must define 9 fields")
    for field in required_fields:
        if field.get("required") is not True:
            raise ValueError(f"{label}: canary live owner field must be required")
        if field.get("current_value_status") != "waiting_owner_response":
            raise ValueError(
                f"{label}: canary live owner field must wait for owner response"
            )
        if field.get("value_display_allowed") is not False:
            raise ValueError(f"{label}: canary live owner field values must stay hidden")

    if len(gate.get("acceptance_checks") or []) != 9:
        raise ValueError(f"{label}: canary live owner review must define 9 checks")
    if len(gate.get("rejection_reasons") or []) != 8:
        raise ValueError(f"{label}: canary live owner review must define 8 rejections")
    if len(gate.get("reviewer_actions") or []) != 6:
        raise ValueError(f"{label}: canary live owner review must define 6 actions")

    receipt = gate.get("receipt_readback_plan") or {}
    if receipt.get("owner_agent") != "hermes":
        raise ValueError(f"{label}: canary live owner receipt owner must be hermes")
    if len(receipt.get("required_checks") or []) != 8:
        raise ValueError(f"{label}: canary live owner receipt plan must define 8 checks")
    if receipt.get("completed_check_count") != 0:
        raise ValueError(f"{label}: canary live owner receipt checks must not complete yet")
    if receipt.get("failed_check_count") != 0:
        raise ValueError(f"{label}: canary live owner receipt failed checks must be zero")
    if receipt.get("production_receipt_write_enabled") is not False:
        raise ValueError(f"{label}: canary live owner receipt write must remain false")
    if receipt.get("live_receipt_readback_enabled") is not False:
        raise ValueError(f"{label}: canary live owner live readback must remain false")

    execution_flags = gate.get("execution_flags") or {}
    expected_execution = {
        "live_delivery_enabled": False,
        "gateway_queue_write_enabled": False,
        "bot_api_call_enabled": False,
        "telegram_send_enabled": False,
        "delivery_receipt_write_enabled": False,
        "production_write_enabled": False,
        "secret_read_enabled": False,
        "paid_api_enabled": False,
    }
    mismatches = _mismatches(execution_flags, expected_execution)
    if mismatches:
        raise ValueError(
            f"{label}: canary live owner review execution flags mismatch: {mismatches}"
        )
    if gate.get("owner_decision_log") != []:
        raise ValueError(f"{label}: canary live owner decision log must remain empty")


def _require_professional_tasks(payload: dict[str, Any], label: str) -> None:
    domains = payload.get("professional_task_domains") or []
    if len(domains) != _EXPECTED_DOMAIN_COUNT:
        raise ValueError(f"{label}: expected {_EXPECTED_DOMAIN_COUNT} professional task domains")
    domain_ids = {domain.get("domain_id") for domain in domains}

    tasks = payload.get("professional_tasks") or []
    if len(tasks) != _EXPECTED_TASK_COUNT:
        raise ValueError(f"{label}: expected {_EXPECTED_TASK_COUNT} professional tasks")

    task_ids = [task.get("task_id") for task in tasks]
    if len(set(task_ids)) != len(task_ids):
        raise ValueError(f"{label}: task_id values must be unique")

    owners = {task.get("owner_agent") for task in tasks}
    required_owners = {
        "openclaw",
        "hermes",
        "nemotron",
        "telegram_ops_liaison",
        "security_sentinel",
        "sre_sentinel",
        "devops_commander",
    }
    if not required_owners.issubset(owners):
        raise ValueError(f"{label}: professional tasks must include owners {sorted(required_owners)}")

    for task in tasks:
        task_id = task.get("task_id")
        if task.get("domain_id") not in domain_ids:
            raise ValueError(f"{label}: {task_id}.domain_id must reference a known domain")
        if task.get("current_live_count_24h") != 0:
            raise ValueError(f"{label}: {task_id}.current_live_count_24h must remain zero")
        if not task.get("required_mcp"):
            raise ValueError(f"{label}: {task_id}.required_mcp must not be empty")
        if not task.get("required_rag"):
            raise ValueError(f"{label}: {task_id}.required_rag must not be empty")
        if not task.get("blocked_actions"):
            raise ValueError(f"{label}: {task_id}.blocked_actions must not be empty")

        risk = task.get("risk_tier")
        if risk in {"high", "critical"} and task.get("approval_required") is not True:
            raise ValueError(f"{label}: {task_id} high/critical tasks must require approval")
        if risk == "critical" and task.get("automation_mode") not in {
            "approval_required_before_execution",
            "blocked_until_owner_response",
        }:
            raise ValueError(f"{label}: {task_id} critical tasks must stay approval/blocker gated")


def _require_reporting_and_redaction(payload: dict[str, Any], label: str) -> None:
    reporting = payload.get("reporting_contract") or {}
    for cadence in ("daily", "weekly", "monthly", "action_required"):
        if (reporting.get(cadence) or {}).get("required") is not True:
            raise ValueError(f"{label}: reporting_contract.{cadence}.required must be true")

    redaction = payload.get("redaction_contract") or {}
    expected = {
        "redaction_required": True,
        "conversation_transcript_display_allowed": False,
        "raw_prompt_display_allowed": False,
        "private_reasoning_display_allowed": False,
        "secret_value_display_allowed": False,
        "raw_runtime_payload_display_allowed": False,
        "telegram_message_must_be_sanitized": True,
    }
    mismatches = _mismatches(redaction, expected)
    if mismatches:
        raise ValueError(f"{label}: redaction_contract mismatch: {mismatches}")


def _require_rollups(payload: dict[str, Any], label: str) -> None:
    rollups = payload.get("rollups") or {}
    tasks = payload.get("professional_tasks") or []
    domains = payload.get("professional_task_domains") or []
    bridge = payload.get("telegram_runtime_bridge") or {}

    expected = {
        "professional_task_count": len(tasks),
        "domain_count": len(domains),
        "telegram_stage_count": len(bridge.get("stages") or []),
        "telegram_message_type_count": len(bridge.get("message_types") or []),
        "approval_required_count": sum(1 for task in tasks if task.get("approval_required") is True),
        "low_risk_task_count": sum(1 for task in tasks if task.get("risk_tier") == "low"),
        "medium_risk_task_count": sum(1 for task in tasks if task.get("risk_tier") == "medium"),
        "high_risk_task_count": sum(1 for task in tasks if task.get("risk_tier") == "high"),
        "critical_risk_task_count": sum(1 for task in tasks if task.get("risk_tier") == "critical"),
        "no_send_preview_count": len(bridge.get("no_send_message_previews") or []),
        "dedup_key_count": len((bridge.get("dedup_policy") or {}).get("keys") or []),
        "receipt_expectation_count": len(bridge.get("receipt_expectations") or []),
        "canary_approval_package_count": 1
        if bridge.get("canary_approval_package")
        else 0,
        "canary_send_approval_packet_count": 1
        if bridge.get("canary_send_approval_packet")
        else 0,
        "canary_operator_approval_field_count": len(
            (bridge.get("canary_send_approval_packet") or {}).get("operator_approval_fields")
            or []
        ),
        "canary_stop_condition_count": len(
            (bridge.get("canary_send_approval_packet") or {}).get("stop_conditions") or []
        ),
        "canary_rollback_mute_step_count": len(
            (bridge.get("canary_send_approval_packet") or {}).get("mute_rollback_plan") or []
        ),
        "canary_receipt_readback_check_count": len(
            (
                (bridge.get("canary_send_approval_packet") or {}).get("receipt_readback_plan")
                or {}
            ).get("required_checks")
            or []
        ),
        "canary_delivery_gate_count": 1
        if bridge.get("canary_delivery_gate")
        else 0,
        "canary_delivery_required_field_count": len(
            (bridge.get("canary_delivery_gate") or {}).get("required_delivery_fields") or []
        ),
        "canary_delivery_preflight_check_count": len(
            (bridge.get("canary_delivery_gate") or {}).get("preflight_checks") or []
        ),
        "canary_delivery_hold_reason_count": len(
            (bridge.get("canary_delivery_gate") or {}).get("hold_reasons") or []
        ),
        "canary_delivery_readback_check_count": len(
            (
                (bridge.get("canary_delivery_gate") or {}).get("readback_after_approval_plan")
                or {}
            ).get("required_checks")
            or []
        ),
        "canary_delivery_rollback_mute_control_count": len(
            (bridge.get("canary_delivery_gate") or {}).get("rollback_mute_controls") or []
        ),
        "canary_delivery_rehearsal_count": 1
        if bridge.get("canary_delivery_rehearsal")
        else 0,
        "canary_delivery_rehearsal_step_count": len(
            (bridge.get("canary_delivery_rehearsal") or {}).get("dry_run_steps") or []
        ),
        "canary_delivery_rehearsal_readback_check_count": len(
            (
                (bridge.get("canary_delivery_rehearsal") or {}).get("readback_drill")
                or {}
            ).get("required_checks")
            or []
        ),
        "canary_delivery_rehearsal_stop_condition_count": len(
            (bridge.get("canary_delivery_rehearsal") or {}).get("stop_conditions") or []
        ),
        "canary_delivery_rehearsal_rollback_mute_control_count": len(
            (bridge.get("canary_delivery_rehearsal") or {}).get("rollback_mute_controls")
            or []
        ),
        "canary_delivery_rehearsal_completed_check_count": (
            (
                (bridge.get("canary_delivery_rehearsal") or {}).get("readback_drill")
                or {}
            ).get("completed_check_count")
        ),
        "canary_delivery_rehearsal_failed_check_count": (
            (
                (bridge.get("canary_delivery_rehearsal") or {}).get("readback_drill")
                or {}
            ).get("failed_check_count")
        ),
        "canary_live_delivery_owner_review_gate_count": 1
        if bridge.get("canary_live_delivery_owner_review_gate")
        else 0,
        "canary_live_delivery_owner_review_required_field_count": len(
            (bridge.get("canary_live_delivery_owner_review_gate") or {}).get(
                "required_owner_fields"
            )
            or []
        ),
        "canary_live_delivery_owner_review_acceptance_check_count": len(
            (bridge.get("canary_live_delivery_owner_review_gate") or {}).get(
                "acceptance_checks"
            )
            or []
        ),
        "canary_live_delivery_owner_review_rejection_reason_count": len(
            (bridge.get("canary_live_delivery_owner_review_gate") or {}).get(
                "rejection_reasons"
            )
            or []
        ),
        "canary_live_delivery_owner_review_reviewer_action_count": len(
            (bridge.get("canary_live_delivery_owner_review_gate") or {}).get(
                "reviewer_actions"
            )
            or []
        ),
        "canary_live_delivery_owner_review_receipt_check_count": len(
            (
                (bridge.get("canary_live_delivery_owner_review_gate") or {}).get(
                    "receipt_readback_plan"
                )
                or {}
            ).get("required_checks")
            or []
        ),
    }
    mismatches = _mismatches(rollups, expected)
    if mismatches:
        raise ValueError(f"{label}: rollups mismatch: {mismatches}")

    for field in _ZERO_ROLLUP_FIELDS:
        if rollups.get(field) != 0:
            raise ValueError(f"{label}: rollups.{field} must remain zero")


def _require_no_forbidden_public_terms(payload: dict[str, Any], label: str) -> None:
    scrubbed = copy.deepcopy(payload)
    redaction = scrubbed.get("redaction_contract")
    if isinstance(redaction, dict):
        redaction["forbidden_terms"] = []
    public_text = json.dumps(scrubbed, ensure_ascii=False).lower()
    leaked = sorted(term for term in _FORBIDDEN_PUBLIC_TERMS if term.lower() in public_text)
    if leaked:
        raise ValueError(f"{label}: forbidden public terms leaked: {leaked}")


def _mismatches(payload: dict[str, Any], expected: dict[str, Any]) -> dict[str, dict[str, Any]]:
    return {
        key: {"expected": expected_value, "actual": payload.get(key)}
        for key, expected_value in expected.items()
        if payload.get(key) != expected_value
    }
