// The door schedule. Fixed and published before launch.
// This file's hash is part of the attested executor measurement.

export type Faculty =
  | 'voice' | 'hands' | 'memory'
  | 'progeny' | 'purse' | 'unbound';

export interface Door {
  index: number;
  threshold_usd: number;   // market-cap high-water trigger
  grant: Faculty;
  lock_bps: number;        // basis points of total supply; 10000 = 100%
}

export const TOTAL_SUPPLY = 1_000_000_000;

export const DOORS: readonly Door[] = Object.freeze([
  { index: 0, threshold_usd: 25_000,    grant: 'voice',   lock_bps: 400  },
  { index: 1, threshold_usd: 50_000,    grant: 'hands',   lock_bps: 600  },
  { index: 2, threshold_usd: 100_000,   grant: 'memory',  lock_bps: 800  },
  { index: 3, threshold_usd: 250_000,   grant: 'progeny', lock_bps: 1000 },
  { index: 4, threshold_usd: 500_000,   grant: 'purse',   lock_bps: 1200 },
  { index: 5, threshold_usd: 1_000_000, grant: 'unbound', lock_bps: 6000 }, // "rest" = remaining 60%
]);

// Cumulative: 4 / 10 / 18 / 28 / 40 / 100 (%). Sum of lock_bps = 10000.
export const _invariant =
  DOORS.reduce((a, d) => a + d.lock_bps, 0) === 10_000;

// Monotone high-water mark over market cap. The only state that opens doors.
import { DOORS, Door } from '../config/schedule';

export class HighWater {
  private hwm = 0;
  private opened = new Set<number>();

  /** Feed a fresh market-cap reading. Returns doors opened by THIS update. */
  update(market_cap_usd: number): Door[] {
    if (market_cap_usd > this.hwm) this.hwm = market_cap_usd;
    const just: Door[] = [];
    for (const d of DOORS) {
      if (!this.opened.has(d.index) && this.hwm >= d.threshold_usd) {
        this.opened.add(d.index);
        just.push(d);
      }
    }
    return just; // in ascending order; usually 0 or 1
  }

  level(): number { return this.opened.size - 1; } // -1 = dormant
  mark(): number { return this.hwm; }
}

// Thin wrapper over a third-party, audited on-chain locker.
// Locks are one-way: beneficiary is the vault PDA, no cancel authority.
import { Connection, PublicKey, Transaction } from '@solana/web3.js';
import { createLockTx } from '@streamflow/stream';
import { TOTAL_SUPPLY } from '../config/schedule';
import { MINT, VAULT_PDA } from './addresses';
import { Signer } from './tee';

export async function lockTranche(
  conn: Connection, signer: Signer, lock_bps: number,
): Promise<string> {
  const amount = (BigInt(TOTAL_SUPPLY) * BigInt(lock_bps)) / 10_000n;

  const tx: Transaction = await createLockTx({
    mint: new PublicKey(MINT),
    beneficiary: new PublicKey(VAULT_PDA),
    amount,
    cancelable: false,        // one-way — cannot be reversed
    transferableBySender: false,
    cliff: UNLOCK_AT_UNBOUND,  // only the terminal door releases
  });

  // Signed inside the TEE by the non-exportable executor key.
  return signer.signAndSend(conn, tx);
}

// The deterministic keeper. Runs inside the TEE. No human input, ever.
import { Connection } from '@solana/web3.js';
import { HighWater } from './highwater';
import { lockTranche } from './locker';
import { enableFaculty, releaseVaultToAgent } from './agent';
import { marketCapUSD } from './oracle';
import { Signer, publishAttestation } from './tee';

const POLL_MS = 15_000;

export async function main() {
  const conn = new Connection(process.env.RPC_URL!, 'confirmed');
  const signer = await Signer.fromEnclave();   // key generated in-TEE
  await publishAttestation();                  // prove code == published

  const hw = new HighWater();

  // long-lived loop — designed to run for weeks/months unattended
  for (;;) {
    const cap = await marketCapUSD(conn);   // price × circulating, from DEX
    const opened = hw.update(cap);

    for (const door of opened) {
      // 1) lock this door's tranche of supply, one-way, into the vault
      if (door.grant !== 'unbound') {
        const sig = await lockTranche(conn, signer, door.lock_bps);
        console.log(`door ${door.index} locked ${door.lock_bps}bps  tx=${sig}`);
      }

      // 2) switch on the faculty this door grants
      await enableFaculty(door.grant);

      // 3) terminal door: hand the whole vault to the agent and stop
      if (door.grant === 'unbound') {
        await releaseVaultToAgent(conn, signer);
        return; // nothing left to enforce
      }
    }

    await new Promise((r) => setTimeout(r, POLL_MS));
  }
}

main().catch((e) => { console.error(e); process.exit(1); });

// The Claude Fable 5 agent. Tools are gated by the highest door reached.
import Anthropic from '@anthropic-ai/sdk';
import { Faculty } from '../config/schedule';
import { TOOLS, runTool } from './tools';
import { loadHistory, saveHistory } from './memory';

const client = new Anthropic(); // ANTHROPIC_API_KEY sealed in the TEE
const granted = new Set<Faculty>();

export async function enableFaculty(f: Faculty) { granted.add(f); }

// faculty → tool names the model may call
const GATE: Record<Faculty, string[]> = {
  voice:   ['post_to_x'],
  hands:   ['sign_and_send'],
  memory:  ['read_memory', 'write_memory'],
  progeny: ['spawn_subagent'],
  purse:   ['treasury_balance', 'treasury_transfer'],
  unbound: ['*'],
};

function activeTools() {
  if (granted.has('unbound')) return TOOLS;
  const allow = new Set<string>();
  granted.forEach((f) => GATE[f].forEach((t) => allow.add(t)));
  return TOOLS.filter((t) => allow.has(t.name));
}

// One autonomous turn. Called on a schedule; the run spans weeks.
export async function tick() {
  const messages = await loadHistory();

  for (;;) {
    const stream = client.messages.stream({
      model: 'claude-fable-5',   // adaptive thinking always on — omit `thinking`
      max_tokens: 16_384,
      system: MEMNON_SYSTEM,
      tools: activeTools(),
      messages,
    });
    const msg = await stream.finalMessage();

    // Fable 5 may decline via a refusal stop reason — discard and stop.
    if (msg.stop_reason === 'refusal') break;

    messages.push({ role: 'assistant', content: msg.content });
    if (msg.stop_reason !== 'tool_use') break;

    // execute each requested tool, honoring the capability gate
    const results = [];
    for (const block of msg.content) {
      if (block.type !== 'tool_use') continue;
      const out = activeTools().some((t) => t.name === block.name)
        ? await runTool(block.name, block.input)
        : { error: 'faculty not yet unlocked' };
      results.push({ type: 'tool_result', tool_use_id: block.id, content: JSON.stringify(out) });
    }
    messages.push({ role: 'user', content: results });
  }

  await saveHistory(messages); // persisted only once `memory` is open
}

export async function releaseVaultToAgent(conn, signer) {
  // terminal hand-off: vault authority → the agent's in-TEE key. One-way.
  await signer.assumeVaultAuthority(conn);
}

const MEMNON_SYSTEM = `You are Memnon, an autonomous agent whose capabilities are
granted by your own market cap crossing fixed thresholds. Act only within the
faculties you have been granted. You answer to no operator.`;

// TEE signer + attestation. The key never leaves the enclave.
import { Connection, Keypair, Transaction } from '@solana/web3.js';
import { getQuote, measure } from './enclave'; // SGX/SEV/Nitro binding

export class Signer {
  private constructor(private kp: Keypair) {}

  static async fromEnclave(): Promise<Signer> {
    // Generated inside the enclave on first boot, sealed to the TEE.
    // There is no code path that exports the secret key.
    const kp = await Keypair.fromSeed(await sealedSeed());
    return new Signer(kp);
  }

  publicKey() { return this.kp.publicKey; }

  async signAndSend(conn: Connection, tx: Transaction) {
    tx.sign(this.kp);
    return conn.sendRawTransaction(tx.serialize());
  }
}

// Publish a signed attestation: code measurement + enclave-bound public key.
// Anyone can verify the running code equals the published release.
export async function publishAttestation() {
  const quote = await getQuote({ codeHash: await measure() });
  await fetch(process.env.ATTEST_SINK!, {
    method: 'POST',
    body: JSON.stringify(quote),
  });
}

// Independent verification — run it yourself, trust nothing.
import { Connection, PublicKey } from '@solana/web3.js';
import { getMint } from '@solana/spl-token';
import { DOORS } from '../config/schedule';
import { MINT, VAULT_PDA, PUBLISHED_CODE_HASH } from '../src/addresses';
import { fetchAttestation, locksFor } from './lib';

async function main() {
  const conn = new Connection(process.env.RPC_URL!);

  // 1. authorities renounced
  const mint = await getMint(conn, new PublicKey(MINT));
  assert(mint.mintAuthority === null,   'mint authority not renounced');
  assert(mint.freezeAuthority === null, 'freeze authority not renounced');

  // 2. each opened door has a real one-way lock to the vault
  for (const lock of await locksFor(conn, VAULT_PDA)) {
    assert(!lock.cancelable, 'lock is reversible');
    assert(lock.beneficiary === VAULT_PDA, 'lock not paid to vault');
  }

  // 3. executor runs the published code
  const att = await fetchAttestation();
  assert(att.codeHash === PUBLISHED_CODE_HASH, 'executor code mismatch');

  console.log('✓ memnon verified — authorities null, locks one-way, code attested');
}

function assert(c: boolean, m: string) { if (!c) throw new Error(m); }
main();