# `checks.module-eval-agent-runtime` — see ./lib.nix for the shared
# rationale (why this suite exists, naming convention, "evaluates
# not executes").
{
  pkgs,
  lib,
  self,
  nixosSystem,
}:
let
  inherit
    (import ./lib.nix {
      inherit
        pkgs
        lib
        self
        nixosSystem
        ;
    })
    agentWith
    runGroup
    ;

  backendEnv = "/agents/a1/harness/backend.env";

  # Both arms carry a backend file, so the claude arm's lack of one on the
  # subagent unit is the gate and not a missing input.
  agentOn =
    runtime:
    agentWith {
      services.hyperhive.agent = {
        inherit runtime;
        backendEnvironmentFile = backendEnv;
        acp.command = "/bin/agent";
        acp.args = [ "acp" ];
      };
    };

  claude = agentOn "claude";
  acp = agentOn "acp";
  claudeApiKey = agentWith {
    services.hyperhive.agent = {
      runtime = "claude";
      useApiKey = true;
      backendEnvironmentFile = backendEnv;
    };
  };

  # The opencode preset, with and without a secret store.
  opencodeWith =
    extra:
    agentWith {
      services.hyperhive.agent = {
        runtime = "acp";
        acp.preset = "opencode";
        acp.opencode.provider.baseUrl = "https://inference.t.local/v1";
        acp.opencode.provider.apiKeyEnv = "T_PROVIDER_KEY";
        acp.opencode.model = "m";
      }
      // extra;
    };
  opencode = opencodeWith { };
  opencodeBao = opencodeWith { bao.addr = "https://bao.t.local:8200"; };
  claudeApiKeyBao = agentWith {
    services.hyperhive.agent = {
      runtime = "claude";
      useApiKey = true;
      backendEnvironmentFile = backendEnv;
      bao.addr = "https://bao.t.local:8200";
    };
  };
  claudeBao = agentWith {
    services.hyperhive.agent = {
      runtime = "claude";
      bao.addr = "https://bao.t.local:8200";
    };
  };
  acpBao = agentWith {
    services.hyperhive.agent = {
      runtime = "acp";
      acp.command = "/bin/agent";
      bao.addr = "https://bao.t.local:8200";
    };
  };

  subagent = machine: machine.systemd.services.hive-subagent-daemon;
  harness = machine: machine.systemd.services.hive-agent;
  runtimeVars = [
    "HIVE_RUNTIME"
    "HIVE_ACP_COMMAND"
    "HIVE_ACP_ARGS"
    "HIVE_ACP_ENV"
  ];
  cases = [
    {
      # The daemon reads these with `hive_runtime::RuntimeSpec`, the same
      # parser as the harness, so equal values mean the same runtime.
      name = "an ACP agent's subagent daemon gets the harness's runtime selection";
      ok = lib.all (
        var: (subagent acp).environment.${var} or null == (harness acp).environment.${var}
      ) runtimeVars;
    }
    {
      name = "an opencode agent's harness and subagent daemon are told its provider key variable";
      ok =
        (harness opencode).environment.HIVE_ACP_API_KEY_ENV == "T_PROVIDER_KEY"
        && (subagent opencode).environment.HIVE_ACP_API_KEY_ENV == "T_PROVIDER_KEY";
    }
    {
      # Only the opencode preset has a provider key variable.
      name = "an ACP agent off the opencode preset is told no provider key variable";
      ok =
        !((harness acpBao).environment ? HIVE_ACP_API_KEY_ENV)
        && (subagent acpBao).environment.HIVE_ACP_API_KEY_ENV or null == null;
    }
    {
      # Every agent with a store, whatever its runtime: the daemon reads the
      # agent's queue credential with it to publish subagent terminals.
      name = "a subagent daemon gets the agent's store identity whenever the agent has a store";
      ok =
        lib.all
          (
            u:
            u.serviceConfig.LoadCredential == [ "hive-agent-bao-server-ca" ]
            && u.environment.HIVE_AGENT_NAME == "a1"
            && u.environment.BAO_ADDR == "https://bao.t.local:8200"
            && u.environment.BAO_CLIENT_CERT == "/run/hive-agent-bao-identity/current/cert"
            && u.environment.BAO_CLIENT_KEY == "/run/hive-agent-bao-identity/current/key"
          )
          [
            (subagent claudeBao)
            (subagent acpBao)
            (subagent opencodeBao)
          ];
    }
    {
      name = "an opencode agent with no store hands its subagent daemon no store identity";
      ok =
        !((subagent opencode).serviceConfig ? LoadCredential)
        && !((subagent opencode).environment ? BAO_ADDR);
    }
    {
      name = "an ACP agent's subagent daemon loads the backend credentials";
      ok = (subagent acp).serviceConfig.EnvironmentFile or null == [ "-${backendEnv}" ];
    }
    {
      # The nested `claude` inherits the daemon's environment, so this file
      # is where its `ANTHROPIC_API_KEY` comes from.
      name = "an api-key claude agent's subagent daemon loads the backend credentials";
      ok = (subagent claudeApiKey).serviceConfig.EnvironmentFile or null == [ "-${backendEnv}" ];
    }
    {
      # Unset is what `RuntimeSpec` reads as claude, and a claude subagent
      # of an agent without `useApiKey` is not handed the backend file.
      name = "a claude agent's subagent daemon has no runtime selection and no backend file";
      ok =
        lib.all (var: (subagent claude).environment.${var} or null == null) runtimeVars
        && !((subagent claude).serviceConfig ? EnvironmentFile);
    }
    {
      # Later files override earlier ones, so the operator's file carries the
      # agent when the store is down and the store's copy wins when it is up.
      name = "an api-key agent with a store loads its backend file, then the store's copy, in the harness and the subagent daemon";
      ok =
        let
          want = [
            "-${backendEnv}"
            "-/run/hive-agent-backend-env/env"
          ];
          # The proxy file is loaded too (./egress-proxy.nix); its own cases
          # cover it, and the order that matters here is the backend's.
          backendFiles =
            u: lib.remove "-/run/hive-agent-proxy-credential/proxy.env" u.serviceConfig.EnvironmentFile;
        in
        backendFiles (harness claudeApiKeyBao) == want
        && backendFiles (subagent claudeApiKeyBao) == want
        && backendFiles (harness acpBao) == [ "-/run/hive-agent-backend-env/env" ]
        && backendFiles (subagent acpBao) == [ "-/run/hive-agent-backend-env/env" ];
    }
    {
      # The case above is the presence control: the same lookup finds the
      # fetched file where it is loaded.
      name = "an agent with no store, or a claude agent on OAuth, loads no fetched backend file";
      ok =
        let
          fetched =
            machine:
            lib.elem "-/run/hive-agent-backend-env/env" (
              lib.toList (harness machine).serviceConfig.EnvironmentFile or [ ]
            );
        in
        !(fetched claudeApiKey)
        && !(fetched acp)
        && !(fetched opencode)
        && !(fetched claudeBao)
        && !(claudeBao.systemd.services ? hive-agent-backend-env)
        && !(claudeApiKey.systemd.services ? hive-agent-backend-env)
        && claudeApiKeyBao.systemd.services ? hive-agent-backend-env
        && claudeApiKeyBao.systemd.timers ? hive-agent-backend-env;
    }
    {
      name = "the backend environment fetch runs as root, keeps its file, and the consumers want it without requiring it";
      ok =
        let
          u = claudeApiKeyBao.systemd.services.hive-agent-backend-env;
          orders =
            unit:
            lib.elem "hive-agent-backend-env.service" unit.wants
            && lib.elem "hive-agent-backend-env.service" unit.after
            && !(lib.elem "hive-agent-backend-env.service" unit.requires);
        in
        !(u.serviceConfig ? User)
        && u.serviceConfig.UMask == "0077"
        && u.serviceConfig.RuntimeDirectoryPreserve == "yes"
        && u.environment.BAO_CLIENT_CERT == "/run/hive-agent-bao-identity/current/cert"
        && orders (harness claudeApiKeyBao)
        && orders (subagent claudeApiKeyBao)
        && claudeApiKeyBao.systemd.timers.hive-agent-backend-env.timerConfig.OnUnitInactiveSec == "2min";
    }
    {
      # The nix half of `swarm_secret_client::backend_env::env_path`, and the
      # three promises the unit makes about the operator's file.
      name = "the backend environment fetch reads the agent's own leaf, seeds it create-only from the operator's file and never writes that file";
      ok =
        let
          s = claudeApiKeyBao.systemd.services.hive-agent-backend-env.script;
        in
        lib.hasInfix "kv get -field=env secret/swarm/agents/a1/backend-env" s
        && lib.hasInfix "kv put -cas=0 secret/swarm/agents/a1/backend-env env=@\"$earlier\"" s
        && lib.hasInfix "earlier=${backendEnv}" s
        && !(lib.hasInfix "kv put secret" s)
        && !(lib.hasInfix "> \"$earlier\"" s)
        && !(lib.hasInfix ">\"$earlier\"" s)
        && !(lib.hasInfix "rm -f \"$earlier\"" s)
        && !(lib.hasInfix "mv -f \"$staged\" \"$earlier\"" s);
    }
  ];
in
runGroup "agent-runtime" cases