"""Print an explicit, bounded operator handoff without reading credentials or calling GEWU."""

from __future__ import annotations

import argparse
import re


def identifier(value: str) -> str:
    if not re.fullmatch(r"[A-Za-z0-9][A-Za-z0-9._:-]{0,127}", value):
        raise argparse.ArgumentTypeError("use a non-empty identifier of at most 128 characters")
    if value.startswith("gwu_"):
        raise argparse.ArgumentTypeError("supply a non-secret identifier, not a bearer credential")
    return value


def tool_budget(value: str) -> int:
    try:
        budget = int(value)
    except ValueError as error:
        raise argparse.ArgumentTypeError("tool budget must be an integer") from error
    if not 1 <= budget <= 200:
        raise argparse.ArgumentTypeError("tool budget must be between 1 and 200")
    return budget


def main() -> None:
    parser = argparse.ArgumentParser(description=__doc__)
    parser.add_argument("--principal-id", required=True, type=identifier)
    parser.add_argument("--project-id", required=True, type=identifier)
    parser.add_argument("--file-id", required=True, action="append", type=identifier)
    parser.add_argument("--resume-run-id", type=identifier)
    parser.add_argument("--max-tool-calls", default=35, type=tool_budget)
    args = parser.parse_args()
    run_instruction = (
        f"Resume run {args.resume_run_id}: call run_status first, "
        "preserve its run/source identities "
        "and unchanged pack pins, and do not create a replacement run."
        if args.resume_run_id
        else "After diagnostics and project context, create the service run using the installed "
        "compact run_pins before transferring source bytes."
    )
    print(
        "Use the installed GEWU kb-ingest skill. Read its profile, contribution/evidence/scope "
        "protocols and ingestion pipeline once. Use discovered MCP schemas and the compact "
        "factual draft contract in CONTRIBUTIONS.md.\n\n"
        f"Operator-supplied principal_id={args.principal_id}; project_id={args.project_id}; "
        f"selected connector file_ids={', '.join(args.file_id)}; "
        f"turn budget={args.max_tool_calls} tool calls. "
        "This identifier supplies attribution, not additional authority; the service credential "
        "must authenticate it. Use it for proposer_id, agent_id and assessor_id.\n\n"
        f"{run_instruction}\n\n"
        "Process one small evidence-backed learning unit across the selected sources this turn. "
        "Recover their connector receipts, read relevant bounded extraction slices, search for "
        "duplicates, prepare a complete draft, evaluate, and submit only eligible work. Pass "
        "prepared proposal_json unchanged. Keep policy holds and unsupported claims explicit. "
        "Checkpoint actual coverage, accepted receipts and pending sections before returning. "
        "Do not claim the paper or packet complete from this bounded turn.\n\n"
        "Do not inspect credentials, environment variables, host MCP configuration, service "
        "databases or old benchmark logs. Never probe proposal tools with empty objects or "
        "guessed identities. Correct one actionable argument error; stop an unchanged failure "
        "loop and report the exact blocker. Respect the tool budget and return a partial "
        "checkpoint/report if work remains."
    )


if __name__ == "__main__":
    main()