"""Check root tracking on fictional data; never stage the real workspace."""

from pathlib import Path
import subprocess
import tempfile


def check(ignore_rules):
    with tempfile.TemporaryDirectory(prefix="wealthledger-tracking-") as directory:
        root = Path(directory)

        def git(*args):
            return subprocess.check_output(
                ["git", "-C", str(root), *args], text=True
            )

        git("init", "--quiet")
        allowed = {
            '.ai/conventions/git.md',
            '.ai/conventions/dependencies.md',
            '.ai/conventions/code-health.md',
            '.ai/conventions/testing.md',
            '.ai/conventions/guardrails.md',
            '.ai/migrations/conventions-v1/audit.md',
            '.ai/migrations/conventions-v1/plan.md',
            '.gitea/workflows/commits.yml',
            '.gitea/workflows/security.yml',
            '.gitea/workflows/verify.yml',
            '.gitignore',
            '.nvmrc',
            '.release-it.json',
            'AGENTS.md',
            'CHANGELOG.md',
            'README.md',
            'commitlint.config.cjs',
            'package-lock.json',
            'package.json',
            'renovate.json',
            'scripts/check-release.cjs',
            'test-release.cjs',
            'test-workspace-tracking.py',
        }
        for name in allowed:
            (root / name).parent.mkdir(parents=True, exist_ok=True)
            (root / name).write_text("fictional fixture\n")
        (root / ".gitignore").write_text(ignore_rules)
        for name in ("frontend", "backend", "docs", "specs"):
            nested = root / name
            nested.mkdir()
            subprocess.run(["git", "init", "--quiet", str(nested)], check=True)
        for name in (
            "frontend/source.ts", "backend/prisma/dev.db", "docs/README.md",
            "specs/README.md", "statement-imports/report.csv", "private.db",
            "private.db-wal", ".env", ".env.example", "audit.pdf",
            "design/preview.html", "todo/notes.md", "references/source.md",
            ".agents/local.md", "unknown-directory/data.txt", "unknown-file.txt",
            "scripts/private.txt", ".gitea/private.txt", ".gitea/workflows/private.yml",
            "node_modules/private.txt",
            ".ai/private.md", ".ai/conventions/private.md",
            ".ai/migrations/private.md", ".ai/migrations/conventions-v1/private.md",
            ".ai/migrations/other/private.md",
        ):
            target = root / name
            target.parent.mkdir(parents=True, exist_ok=True)
            target.write_text("fictional private data\n")
        before = {p.relative_to(root): p.read_bytes() for p in root.rglob("*")
                  if p.is_file() and ".git" not in p.relative_to(root).parts[:1]}
        git("add", ".")
        assert set(git("ls-files").splitlines()) == allowed
        assert all((root / p).read_bytes() == content for p, content in before.items())
        assert all((root / name / ".git").is_dir()
                   for name in ("frontend", "backend", "docs", "specs"))


if __name__ == "__main__":
    check(Path(__file__).with_name(".gitignore").read_text())
    print("PASS: only root allowlist staged; fictional data and nested Git preserved")