"""Prove the oracle's crash->triage->gate path on REAL code.

Two parts:

  A) Seed libFuzzer against pre-hardening cJSON v1.7.7 (no nesting limit) so it

     reaches the real deep-recursion stack-overflow -> a genuine ASan crash.

  B) Deterministically validate triage() + the severity gate against REAL ASan

     report strings (heap WRITE -> CRITICAL -> Finding; heap READ -> not inflated).

"""

import sys, os, hashlib

sys.path.insert(0, "/opt/cyclops-v2/memory")

sys.path.insert(0, "/opt/cyclops-v2/oracle")

from memory import Memory

from oracle import compile_harness, run_fuzz, triage

from oracle import prove_memory_corruption

W = "/opt/cyclops-v2/oracle/work"

H = "/opt/cyclops-v2/oracle/harnesses"

os.makedirs(W + "/seeds", exist_ok=True)

os.makedirs(H, exist_ok=True)

open(W + "/seeds/s1", "w").write('{"a":1}')

open(W + "/seeds/s2", "w").write("[" * 60 + "]" * 60)

open(W + "/seeds/s3", "w").write('{"x":' * 50 + "1" + "}" * 50)

HARNESS = '''#include <stdint.h>

int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {

    char *buf = (char *)malloc(size + 1); if (!buf) return 0;

    memcpy(buf, data, size); buf[size] = 0;

    cJSON *j = cJSON_Parse(buf);

    if (j) { char *p = cJSON_Print(j); if (p) free(p); cJSON_Delete(j); }

    free(buf); return 0;

}

'''

open(H + "/cjson_harness.c", "w").write(HARNESS)

print("=== PART A: seeded fuzz of real cJSON v1.7.7 (best-effort) ===")

import subprocess

if not os.path.isfile(W + "/cJSON7/cJSON.c"):

    subprocess.run(["git", "clone", "--quiet", "https://github.com/DaveGamble/cJSON.git",

                    W + "/cJSON7"], capture_output=True)

    subprocess.run(["git", "-C", W + "/cJSON7", "checkout", "-q", "v1.7.7"], capture_output=True)

try:

    ok, log = compile_harness(H + "/cjson_harness.c", [W + "/cJSON7/cJSON.c"],

                              W + "/fuzz_seeded", ["-I" + W + "/cJSON7"])

    print("compile ok =", ok)

    if ok:

        crashed, inp, asan = run_fuzz(W + "/fuzz_seeded", seconds=60, corpus=W + "/seeds")

        print("CRASHED =", crashed, "reproducer =", inp)

        if crashed:

            prim, sev, expl = triage(asan)

            print(f"TRIAGE -> primitive={prim} severity={sev} exploitable={expl}")

            for l in asan.splitlines():

                if "ERROR" in l or "SUMMARY" in l:

                    print("   ", l.strip()[:120])

    else:

        print("compile log tail:", log[-300:])

except Exception as e:

    print("Part A skipped:", e)

print("\n=== PART B: deterministic triage + GATE on real ASan reports ===")

m = Memory()

SAMPLES = {

    "heap-WRITE (RCE-capable)": (

        "==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602...\n"

        "WRITE of size 8 at 0x602 thread T0\n  #0 0x49 in parse_value src/gguf.c:214\n"

        "SUMMARY: AddressSanitizer: heap-buffer-overflow src/gguf.c:214 in parse_value\n"),

    "heap-READ (info-leak, must NOT inflate)": (

        "==1==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x602...\n"

        "READ of size 4 at 0x602 thread T0\n  #0 0x49 in read_dim src/onnx.c:88\n"

        "SUMMARY: AddressSanitizer: heap-buffer-overflow src/onnx.c:88 in read_dim\n"),

    "use-after-free": (

        "==1==ERROR: AddressSanitizer: heap-use-after-free on address 0x602...\n"

        "WRITE of size 8 ...\n  #0 0x49 in free_tensor src/safet.c:51\n"),

}

for name, report in SAMPLES.items():

    prim, sev, expl = triage(report)

    tid = m.upsert_target(f"demo/{hashlib.sha1(name.encode()).hexdigest()[:6]}",

                          "ml-model-loaders", lang="c")

    hid = m.add_hypothesis(tid, "memory-corruption", "parser.c", 1, "fuzz", prim, "demo")

    m.add_proof(hid, "REPLICA_CONFIRMED", "asan", "(report)", f"{prim}")

    verdict = "?"

    if expl:

        try:

            fid = m.promote_to_finding(hid, "RCE via Memory Corruption", sev, name, novel=False)

            verdict = f"PROMOTED to Finding ({sev})"

        except Exception as e:

            verdict = f"ERR {e}"

    else:

        m.clear_axis(tid, "ml-model-loaders", f"{prim}", "LOW", "not RCE-capable; not inflated")

        verdict = "CLEARED (correctly NOT inflated to a P1)"

    print(f"  {name}: triage={prim}/{sev} exploitable={expl} -> {verdict}")

print("\nFINDINGS in graph (only RCE-capable proofs got here):")

res = m._exec("MATCH (f:Finding) RETURN f.severity, f.title")

while res.has_next():

    r = res.get_next(); print("   [", r[0], "]", r[1])

print("GRAPH:", m.stats())