export const commanderServiceId = "host-codex-commander";

export const commanderPhase = "source-contract";

export const commanderHighRiskActions = [
  "code-queue-backend-restart",
  "code-queue-backend-rebuild",
  "code-queue-execution-plane-restart",
  "code-queue-task-interrupt",
  "code-queue-task-cancel",
  "prod-runtime-mutation",
] as const;

export type CommanderHighRiskAction = typeof commanderHighRiskActions[number];

export type CommanderSessionState =
  | "unknown"
  | "discovered"
  | "planned"
  | "starting"
  | "running"
  | "attention_required"
  | "stopping"
  | "stopped"
  | "degraded";

export type CommanderPromptState =
  | "draft"
  | "planned"
  | "queued_for_injection"
  | "injected"
  | "rejected"
  | "failed";

export type CommanderApprovalState =
  | "draft"
  | "requested"
  | "approved"
  | "rejected"
  | "expired"
  | "consumed";

export interface CommanderContract {
  ok: true;
  phase: typeof commanderPhase;
  serviceId: typeof commanderServiceId;
  currentImplementation: "host-codex-commander-skeleton";
  daemonImplemented: false;
  liveOperationsImplemented: false;
  purpose: string;
  ownershipBoundary: {
    hostCodexProcess: string;
    controlMicroservice: string;
    codeQueue: string;
    claudeqq: string;
    githubPrCloseout: string;
  };
  requiredCapabilities: string[];
  apiContract: {
    health: string;
    contract: string;
    sessions: string;
    sessionPlan: string;
    promptPlan: string;
    traceSummary: string;
    issueWritePlan: string;
    approvalRequest: string;
  };
  stateModel: {
    sessionStates: CommanderSessionState[];
    promptStates: CommanderPromptState[];
    approvalStates: CommanderApprovalState[];
    storageRoot: ".state/commander/";
    redactionPolicy: string;
  };
  safetyBoundary: {
    phaseOneMutationAllowed: false;
    forbiddenWithoutExplicitUserApproval: CommanderHighRiskAction[];
    alwaysForbidden: string[];
    confirmationPolicy: string;
  };
}

export function commanderContract(): CommanderContract {
  return {
    ok: true,
    phase: commanderPhase,
    serviceId: commanderServiceId,
    currentImplementation: "host-codex-commander-skeleton",
    daemonImplemented: false,
    liveOperationsImplemented: false,
    purpose: "Keep host Codex supervision observable through a local-only skeleton that can persist state, summarize traces, and draft approvals without touching live bridges.",
    ownershipBoundary: {
      hostCodexProcess: "Long-lived Codex process on the master server host.",
      controlMicroservice: "Local skeleton for health, state, trace summary, and approval drafting with no live bridge or executor.",
      codeQueue: "Execution plane remains separate and is never restarted or attached by this skeleton.",
      claudeqq: "Approval draft destination only in this stage; any future authorized send must use backend-core /api/microservices/claudeqq/proxy, never the local skill/powershell path.",
      githubPrCloseout: "PR-bound GPT-5.5 runners may self-close/merge ordinary in-boundary PRs after checks; commander review remains required for high-risk, ambiguous, failed-check, production, release, security, database, or runtime scopes.",
    },
    requiredCapabilities: [
      "host-codex-process-discovery",
      "host-codex-start-plan",
      "ssh-bridge-contract",
      "pty-bridge-contract",
      "stdio-bridge-contract",
      "prompt-guidance-plan",
      "trace-summary-plan",
      "issue-20-board-read-write-entry",
      "issue-46-brief-read-write-entry",
      "pr-closeout-boundary-plan",
      "claudeqq-high-risk-approval-entry",
    ],
    apiContract: {
      health: "GET /health",
      contract: "GET /api/commander/contract",
      sessions: "GET /api/commander/sessions",
      sessionPlan: "POST /api/commander/sessions/:sessionId/plan-start",
      promptPlan: "POST /api/commander/sessions/:sessionId/prompt-plan",
      traceSummary: "GET /api/commander/trace-summary",
      issueWritePlan: "POST /api/commander/issues/:issueNumber/write-plan",
      approvalRequest: "POST /api/commander/approvals",
    },
    stateModel: {
      sessionStates: ["unknown", "discovered", "planned", "starting", "running", "attention_required", "stopping", "stopped", "degraded"],
      promptStates: ["draft", "planned", "queued_for_injection", "injected", "rejected", "failed"],
      approvalStates: ["draft", "requested", "approved", "rejected", "expired", "consumed"],
      storageRoot: ".state/commander/",
      redactionPolicy: "Never persist or print token, secret, password, key, cookie, authorization, or credential URLs in cleartext.",
    },
    safetyBoundary: {
      phaseOneMutationAllowed: false,
      forbiddenWithoutExplicitUserApproval: [...commanderHighRiskActions],
      alwaysForbidden: [
        "print-token-values",
        "read-token-files-for-display",
        "direct-database-state-patch",
        "bypass-code-queue-backend-confirmation-policy",
        "replace-code-queue-runner",
        "deploy-or-restart-production-runtime-from-this-contract-stub",
      ],
      confirmationPolicy: "High-risk actions must draft a ClaudeQQ request, wait for explicit user approval, bind approval to one exact action, and record the decision before any future live executor may proceed.",
    },
  };
}
