"""Bundle-local automatic launch-profile binding, before importing FLA.

One profile is active per Python process. Repeated loading of the same verified
profile is allowed; mixing with an unprofiled/different-profile model is not.
"""
import hashlib,importlib.util,json,os,sys,types
from pathlib import Path
STATE='_decision_process_normalization_profile_v1'
def sha(p):return hashlib.sha256(Path(p).read_bytes()).hexdigest()
def safe(root,relative):
 p=Path(relative)
 if p.is_absolute() or '..' in p.parts:raise ValueError('Unsafe runtime-profile path')
 return root/p

def ensure_profile(bundle):
 bundle=Path(bundle).resolve();runtime=json.loads((bundle/'runtime.json').read_text());spec=runtime.get('normalization_profile');active=sys.modules.get(STATE)
 if spec is None:
  if active is not None:raise RuntimeError('Load unprofiled and profiled Decision models in separate processes')
  return None
 if spec.get('kind')!='decision-fla-l2norm-profile-v1' or spec.get('validated_arch')!='gfx942':raise ValueError('Unknown normalization profile contract')
 profile=safe(bundle,spec['profile_file']);guard=safe(bundle,spec['guard_file'])
 if sha(profile)!=spec['profile_sha256'] or sha(guard)!=spec['guard_sha256']:raise ValueError('Bound runtime profile bytes changed')
 if json.loads((bundle/'decision_config.json').read_text()).get('base_model')!='Qwen/Qwen3.5-4B':raise ValueError('This bundle profile is bound to the validated Nox family only')
 if active is not None:
  if active.profile_sha256!=spec['profile_sha256'] or active.guard_sha256!=spec['guard_sha256']:raise RuntimeError('Different Decision normalization profile is already active; use a separate process')
  active.guard.validate_profile(profile,spec['profile_sha256'])
  if os.environ.get('FLA_CACHE_MODE')!='strict' or os.environ.get('FLA_CONFIG_DIR')!=active.profile_dir:raise RuntimeError('Active FLA profile environment changed')
  return {'profile_sha256':active.profile_sha256,'guard_sha256':active.guard_sha256,'validated_arch':'gfx942','automatic_bundle_binding':True,'scope':'single profile per process'}
 module_spec=importlib.util.spec_from_file_location('decision_profile_guard_'+spec['guard_sha256'][:16],guard);module=importlib.util.module_from_spec(module_spec);module_spec.loader.exec_module(module)
 telemetry=module.install(profile,spec['profile_sha256'])
 state=types.ModuleType(STATE);state.profile_sha256=spec['profile_sha256'];state.guard_sha256=spec['guard_sha256'];state.profile_dir=str(profile.parent);state.guard=module;state.telemetry=telemetry;sys.modules[STATE]=state
 return {'profile_sha256':state.profile_sha256,'guard_sha256':state.guard_sha256,'validated_arch':'gfx942','automatic_bundle_binding':True,'scope':'single profile per process'}

def active_telemetry():
 state=sys.modules.get(STATE)
 return None if state is None else dict(state.telemetry)