dds

#!/usr/bin/env python3
"""Reuse (or seed) judged verdicts from a prior run of this tree.

The check is f(tree): identical input tree, identical honest conclusion.
A merged PR otherwise pays the judged (sonnet) leg twice — once on the PR
head, minutes later on a byte-identical master tree (fast-forward / clean
merge). So this step reuses the ONE agent-supplied input
(`.dds-verdicts.json`) from the newest prior artifact that attests this
exact tree.

This weakens nothing: the gate downstream still re-derives every
mechanical finding and RE-REPLAYS every evidence record against this
checkout — a wrong reuse can only fail loudly, exactly as a fresh
judgment would. Only the LLM translation is inherited, and it is
f(tree)-valid by the architecture's own theorem.

Outcomes (all written relative to the current working directory):

  * Exact-tree hit — a prior artifact attests THIS tree: its verdicts are
    written to `.dds-verdicts.json` and `hit=true` / `reused_from=<run>`
    are appended to `$GITHUB_OUTPUT`. The judged leg is skipped entirely.
  * Seed — a prior artifact exists for a DIFFERENT tree: its verdicts are
    written to `.dds-seed.json`. The batch driver inherits any whose
    evidence replays clean on this tree and re-judges only the disturbed
    nominees.
  * Fresh — no prior artifact carries verdicts: nothing is written; the
    judged leg runs from scratch.

Usage:
    reuse_verdicts.py <tree-sha>

Environment:
    GITHUB_REPOSITORY   owner/repo (required)
    GITHUB_OUTPUT       path to the step-output file (required for a hit)

Requires the `gh` CLI on PATH (authenticated via GH_TOKEN in the
workflow). Stdlib only otherwise.
"""

import io
import json
import os
import subprocess
import sys
import zipfile

WORKFLOW = "dds-check.yml"
ARTIFACT_NAME = "dds-check-json"
DOC_NAME = "dds-check.json"
RUNS_PER_PAGE = 15


def gh(*args, binary=False):
    """Run a `gh` subcommand; return stdout (str, or bytes if binary) or None on error."""
    r = subprocess.run(("gh",) + args, capture_output=True)
    if r.returncode != 0:
        print(r.stderr.decode(errors="replace"), file=sys.stderr)
        return None
    return r.stdout if binary else r.stdout.decode()


def completed_run_ids(repo):
    runs = gh(
        "api",
        f"repos/{repo}/actions/workflows/{WORKFLOW}/runs"
        f"?status=completed&per_page={RUNS_PER_PAGE}",
        "--jq",
        "[.workflow_runs[].id]",
    )
    return json.loads(runs or "[]")


def artifact_ids(repo, run_id):
    arts = gh(
        "api",
        f"repos/{repo}/actions/runs/{run_id}/artifacts",
        "--jq",
        f'[.artifacts[] | select(.name == "{ARTIFACT_NAME}"'
        " and (.expired | not)) | .id]",
    )
    return json.loads(arts or "[]")


def load_doc(repo, art_id):
    """Download an artifact zip and return the parsed check doc, or None."""
    blob = gh("api", f"repos/{repo}/actions/artifacts/{art_id}/zip", binary=True)
    if not blob:
        return None
    try:
        with zipfile.ZipFile(io.BytesIO(blob)) as z:
            return json.loads(z.read(DOC_NAME))
    except Exception as e:
        print(f"artifact {art_id}: unreadable ({e}) — skipped")
        return None


def main():
    tree = sys.argv[1]
    repo = os.environ["GITHUB_REPOSITORY"]
    newest = None

    for run_id in completed_run_ids(repo):
        for art_id in artifact_ids(repo, run_id):
            doc = load_doc(repo, art_id)
            if not doc:
                continue
            if newest is None and doc.get("verdicts"):
                newest = doc
            if doc.get("tree") == tree and doc.get("verdicts"):
                json.dump(
                    doc["verdicts"],
                    open(".dds-verdicts.json", "w"),
                    indent=1,
                )
                print(
                    f"tree {tree[:12]} already judged by run {run_id} — "
                    f"reusing its {len(doc['verdicts'])} verdicts; "
                    "the gate re-replays every evidence record"
                )
                with open(os.environ["GITHUB_OUTPUT"], "a") as out:
                    out.write(f"hit=true\nreused_from={run_id}\n")
                raise SystemExit(0)

    if newest:
        # different tree — the verdicts are still SEED material: the batch
        # driver inherits any whose evidence replays clean on this tree and
        # re-judges only the disturbed nominees.
        json.dump(newest["verdicts"], open(".dds-seed.json", "w"), indent=1)
        print(
            f"no artifact attests tree {tree[:12]} — seeding the judged "
            f"leg with {len(newest['verdicts'])} prior verdict(s) "
            f"(tree {str(newest.get('tree'))[:12]}) for replay-filtered inheritance"
        )
    else:
        print(f"no prior artifact attests tree {tree[:12]} — the judged leg runs fresh")


if __name__ == "__main__":
    main()