Stage 3: EXPAND + MASTER PLAN

-- gvc schema
CREATE SCHEMA IF NOT EXISTS gvc;

-- Main trajectory version table
CREATE TABLE gvc.trajectory_versions (
    id              UUID PRIMARY KEY DEFAULT gen_random_uuid(),
    parent_ids      UUID[] DEFAULT '{}',
    content_hash    TEXT NOT NULL,           -- SHA-256 hex
    agent_id        INTEGER NOT NULL,        -- matches agent-registry on-chain ID
    agent_device    TEXT NOT NULL,            -- vm, mac1, mac3, mac4, laptop
    skill_label     TEXT NOT NULL,            -- from KARL routing
    reward_score    DOUBLE PRECISION NOT NULL CHECK (reward_score >= 0 AND reward_score <= 1),
    tool_events     JSONB DEFAULT '[]',      -- tool calls, file paths, bash commands
    file_diffs      JSONB DEFAULT '{}',      -- files touched + patch summaries
    embedding       vector(3072),            -- gemini-embedding-001
    prompt_hash     TEXT,                    -- SHA-256 of original prompt
    outcome_summary TEXT,                    -- natural language summary
    created_at      TIMESTAMPTZ NOT NULL DEFAULT now(),
    anchored        BOOLEAN NOT NULL DEFAULT false,
    anchor_batch_id INTEGER,                 -- FK to anchor_batches
    merkle_proof    BYTEA,                   -- serialized Merkle proof
    CONSTRAINT valid_hash CHECK (length(content_hash) = 64)
);

-- Indexes
CREATE INDEX idx_tv_agent ON gvc.trajectory_versions(agent_id);
CREATE INDEX idx_tv_skill ON gvc.trajectory_versions(skill_label);
CREATE INDEX idx_tv_reward ON gvc.trajectory_versions(reward_score DESC);
CREATE INDEX idx_tv_created ON gvc.trajectory_versions(created_at DESC);
CREATE INDEX idx_tv_anchored ON gvc.trajectory_versions(anchored) WHERE NOT anchored;
CREATE INDEX idx_tv_embedding ON gvc.trajectory_versions USING ivfflat (embedding vector_cosine_ops)
    WITH (lists = 20);  -- adjusted for current scale (~150 trajectories)

-- Edge table
CREATE TABLE gvc.trajectory_edges (
    id          BIGSERIAL PRIMARY KEY,
    parent_id   UUID NOT NULL REFERENCES gvc.trajectory_versions(id),
    child_id    UUID NOT NULL REFERENCES gvc.trajectory_versions(id),
    edge_type   TEXT NOT NULL CHECK (edge_type IN (
        'Derives', 'Supersedes', 'Conflicts', 'Refines', 'Composes', 'Grafts'
    )),
    weight      DOUBLE PRECISION NOT NULL DEFAULT 1.0 CHECK (weight >= 0 AND weight <= 1),
    created_at  TIMESTAMPTZ NOT NULL DEFAULT now(),
    UNIQUE(parent_id, child_id, edge_type)
);

CREATE INDEX idx_te_parent ON gvc.trajectory_edges(parent_id);
CREATE INDEX idx_te_child ON gvc.trajectory_edges(child_id);
CREATE INDEX idx_te_type ON gvc.trajectory_edges(edge_type);

-- Anchor batches
CREATE TABLE gvc.anchor_batches (
    id                  SERIAL PRIMARY KEY,
    merkle_root         TEXT NOT NULL,         -- hex
    trajectory_count    INTEGER NOT NULL,
    data_plane_hash     TEXT NOT NULL,         -- hex
    agent_count         INTEGER NOT NULL,
    reward_sum          DOUBLE PRECISION NOT NULL,
    stacks_block_height INTEGER,              -- null until confirmed
    stacks_tx_id        TEXT,                 -- null until confirmed
    submitted_at        TIMESTAMPTZ NOT NULL DEFAULT now(),
    confirmed_at        TIMESTAMPTZ,
    status              TEXT NOT NULL DEFAULT 'pending'
                        CHECK (status IN ('pending', 'submitted', 'confirmed', 'failed'))
);

-- Agent policies
CREATE TABLE gvc.agent_policies (
    agent_id            INTEGER PRIMARY KEY,
    policy_name         TEXT NOT NULL,
    policy_json         JSONB NOT NULL,        -- full TrajectorySlicePolicy
    policy_hash         TEXT NOT NULL,          -- SHA-256 of canonical policy JSON
    on_chain_synced     BOOLEAN NOT NULL DEFAULT false,
    last_synced_block   INTEGER,
    updated_at          TIMESTAMPTZ NOT NULL DEFAULT now()
);

-- Merge log
CREATE TABLE gvc.merge_log (
    id              SERIAL PRIMARY KEY,
    branch_a_tip    UUID NOT NULL REFERENCES gvc.trajectory_versions(id),
    branch_b_tip    UUID NOT NULL REFERENCES gvc.trajectory_versions(id),
    merge_result_id UUID REFERENCES gvc.trajectory_versions(id),
    strategy        TEXT NOT NULL,
    reward_a        DOUBLE PRECISION NOT NULL,
    reward_b        DOUBLE PRECISION NOT NULL,
    reward_delta    DOUBLE PRECISION NOT NULL,
    grafted_ids     UUID[] DEFAULT '{}',
    discarded_ids   UUID[] DEFAULT '{}',
    initiated_by    TEXT NOT NULL,             -- agent_id or 'human'
    created_at      TIMESTAMPTZ NOT NULL DEFAULT now()
);

-- RLS policies
ALTER TABLE gvc.trajectory_versions ENABLE ROW LEVEL SECURITY;
ALTER TABLE gvc.trajectory_edges ENABLE ROW LEVEL SECURITY;
ALTER TABLE gvc.anchor_batches ENABLE ROW LEVEL SECURITY;
ALTER TABLE gvc.agent_policies ENABLE ROW LEVEL SECURITY;
ALTER TABLE gvc.merge_log ENABLE ROW LEVEL SECURITY;

-- Service role can read/write everything
CREATE POLICY gvc_service_all ON gvc.trajectory_versions
    FOR ALL TO service_role USING (true) WITH CHECK (true);
CREATE POLICY gvc_service_all ON gvc.trajectory_edges
    FOR ALL TO service_role USING (true) WITH CHECK (true);
CREATE POLICY gvc_service_all ON gvc.anchor_batches
    FOR ALL TO service_role USING (true) WITH CHECK (true);
CREATE POLICY gvc_service_all ON gvc.agent_policies
    FOR ALL TO service_role USING (true) WITH CHECK (true);
CREATE POLICY gvc_service_all ON gvc.merge_log
    FOR ALL TO service_role USING (true) WITH CHECK (true);

-- Anon/authenticated can only read
CREATE POLICY gvc_read ON gvc.trajectory_versions
    FOR SELECT TO anon, authenticated USING (true);
CREATE POLICY gvc_read ON gvc.trajectory_edges
    FOR SELECT TO anon, authenticated USING (true);
CREATE POLICY gvc_read ON gvc.anchor_batches
    FOR SELECT TO anon, authenticated USING (true);
CREATE POLICY gvc_read ON gvc.merge_log
    FOR SELECT TO anon, authenticated USING (true);

use serde::{Deserialize, Serialize};

/// Policy for slicing the trajectory DAG.
/// Extends SlicePolicyV1 with trajectory-specific parameters.
#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct TrajectorySlicePolicy {
    // Inherited from SlicePolicyV1
    pub max_nodes: usize,
    pub max_depth: u32,
    pub max_siblings: usize,
    pub salience_weight: f32,
    pub depth_weight: f32,
    pub temporal_weight: f32,
    pub min_salience: f32,
    // Trajectory-specific
    pub reward_weight: f32,
    pub min_reward: f32,
    pub follow_supersedes: bool,
    pub include_conflicts: bool,
    pub skill_filter: Option<Vec<String>>,
    pub device_filter: Option<Vec<String>>,
}

impl Default for TrajectorySlicePolicy {
    fn default() -> Self {
        Self {
            max_nodes: 50,
            max_depth: 5,
            max_siblings: 3,
            salience_weight: 0.3,
            depth_weight: 0.2,
            temporal_weight: 0.2,
            min_salience: 0.1,
            reward_weight: 0.3,
            min_reward: 0.0,
            follow_supersedes: true,
            include_conflicts: false,
            skill_filter: None,
            device_filter: None,
        }
    }
}

/// Named trajectory policy presets.
impl TrajectorySlicePolicy {
    pub fn restricted() -> Self {
        Self {
            max_nodes: 10,
            max_depth: 1,
            max_siblings: 2,
            min_reward: 0.4,
            include_conflicts: false,
            ..Default::default()
        }
    }

    pub fn standard() -> Self {
        Self::default()
    }

    pub fn wide() -> Self {
        Self {
            max_nodes: 200,
            max_depth: 10,
            max_siblings: 10,
            min_salience: 0.0,
            min_reward: 0.0,
            include_conflicts: true,
            ..Default::default()
        }
    }
}

// POST /api/trajectory/slice
async fn trajectory_slice_handler(
    State(state): State<Arc<AppState>>,
    Json(request): Json<TrajectorySliceRequest>,
) -> Result<Json<TrajectorySliceResponse>, (StatusCode, Json<ErrorResponse>)>;

// POST /api/trajectory/lineage
async fn trajectory_lineage_handler(
    State(state): State<Arc<AppState>>,
    Json(request): Json<TrajectoryLineageRequest>,
) -> Result<Json<TrajectoryLineageResponse>, (StatusCode, Json<ErrorResponse>)>;

// POST /api/trajectory/conflicts
async fn trajectory_conflicts_handler(
    State(state): State<Arc<AppState>>,
    Json(request): Json<TrajectoryConflictsRequest>,
) -> Result<Json<TrajectoryConflictsResponse>, (StatusCode, Json<ErrorResponse>)>;

// GET /api/trajectory/main-path
async fn main_path_handler(
    State(state): State<Arc<AppState>>,
) -> Result<Json<MainPathResponse>, (StatusCode, Json<ErrorResponse>)>;

;; title: trajectory-anchor
;; version: 1.0.0
;; summary: Merkle root anchoring for agent trajectory batches
;; description: Stores Merkle roots of trajectory batches on-chain.
;;   Each anchor covers N trajectories. Any trajectory can be verified
;;   against its batch's Merkle root using the verify-membership function.
;;   Supports up to 10-level Merkle proofs (1024 trajectories per batch).

(define-data-var contract-owner principal tx-sender)
(define-data-var pending-owner (optional principal) none)
(define-data-var anchor-count uint u0)

(define-constant ERR_NOT_AUTHORIZED (err u700))
(define-constant ERR_INVALID_PROOF (err u701))
(define-constant ERR_NO_ANCHOR (err u702))
(define-constant ERR_INVALID_INPUT (err u703))

;; Batch anchors
(define-map anchors uint {
  merkle-root: (buff 32),
  trajectory-count: uint,
  data-plane-hash: (buff 32),
  agent-count: uint,
  reward-sum-x1000: uint,
  prev-anchor-id: uint,
  block: uint
})

;; Per-agent latest anchor tracking
(define-map agent-latest-anchor uint uint)

;; Anchor statistics
(define-data-var total-trajectories-anchored uint u0)
(define-data-var total-reward-anchored uint u0)

;; Submit a new batch anchor
(define-public (submit-anchor
    (merkle-root (buff 32))
    (trajectory-count uint)
    (data-plane-hash (buff 32))
    (agent-count uint)
    (reward-sum-x1000 uint))
  (let ((anchor-id (var-get anchor-count))
        (prev-id (if (> anchor-id u0) (- anchor-id u1) u0)))
    (asserts! (is-eq tx-sender (var-get contract-owner)) ERR_NOT_AUTHORIZED)
    (asserts! (> trajectory-count u0) ERR_INVALID_INPUT)
    (map-set anchors anchor-id {
      merkle-root: merkle-root,
      trajectory-count: trajectory-count,
      data-plane-hash: data-plane-hash,
      agent-count: agent-count,
      reward-sum-x1000: reward-sum-x1000,
      prev-anchor-id: prev-id,
      block: block-height
    })
    (var-set anchor-count (+ anchor-id u1))
    (var-set total-trajectories-anchored
      (+ (var-get total-trajectories-anchored) trajectory-count))
    (var-set total-reward-anchored
      (+ (var-get total-reward-anchored) reward-sum-x1000))
    (ok anchor-id)))

;; Update per-agent latest anchor
(define-public (set-agent-anchor (agent-id uint) (anchor-id uint))
  (begin
    (asserts! (is-eq tx-sender (var-get contract-owner)) ERR_NOT_AUTHORIZED)
    (asserts! (is-some (map-get? anchors anchor-id)) ERR_NO_ANCHOR)
    (map-set agent-latest-anchor agent-id anchor-id)
    (ok true)))

;; 10-level Merkle proof verification (supports up to 1024 leaves)
;; Each sibling-N/side-N pair represents one level of the tree.
;; Pass 0x00...00 for unused levels (leaves < 2^10).
(define-read-only (verify-membership
    (anchor-id uint) (leaf-hash (buff 32))
    (s0 (buff 32)) (d0 bool)
    (s1 (buff 32)) (d1 bool)
    (s2 (buff 32)) (d2 bool)
    (s3 (buff 32)) (d3 bool)
    (s4 (buff 32)) (d4 bool)
    (s5 (buff 32)) (d5 bool)
    (s6 (buff 32)) (d6 bool)
    (s7 (buff 32)) (d7 bool)
    (s8 (buff 32)) (d8 bool)
    (s9 (buff 32)) (d9 bool))
  (match (map-get? anchors anchor-id)
    anchor
    (let (
      (h0 (if d0 (sha256 (concat s0 leaf-hash)) (sha256 (concat leaf-hash s0))))
      (h1 (if d1 (sha256 (concat s1 h0)) (sha256 (concat h0 s1))))
      (h2 (if d2 (sha256 (concat s2 h1)) (sha256 (concat h1 s2))))
      (h3 (if d3 (sha256 (concat s3 h2)) (sha256 (concat h2 s3))))
      (h4 (if d4 (sha256 (concat s4 h3)) (sha256 (concat h3 s4))))
      (h5 (if d5 (sha256 (concat s5 h4)) (sha256 (concat h4 s5))))
      (h6 (if d6 (sha256 (concat s6 h5)) (sha256 (concat h5 s6))))
      (h7 (if d7 (sha256 (concat s7 h6)) (sha256 (concat h6 s7))))
      (h8 (if d8 (sha256 (concat s8 h7)) (sha256 (concat h7 s8))))
      (h9 (if d9 (sha256 (concat s9 h8)) (sha256 (concat h8 s9))))
    )
      (ok (is-eq h9 (get merkle-root anchor))))
    ERR_NO_ANCHOR))

;; Read-only
(define-read-only (get-anchor (anchor-id uint))
  (map-get? anchors anchor-id))

(define-read-only (get-anchor-count)
  (var-get anchor-count))

(define-read-only (get-agent-latest-anchor (agent-id uint))
  (map-get? agent-latest-anchor agent-id))

(define-read-only (get-system-stats)
  {
    anchor-count: (var-get anchor-count),
    total-trajectories: (var-get total-trajectories-anchored),
    total-reward-x1000: (var-get total-reward-anchored)
  })

;; Two-step ownership transfer
(define-public (propose-owner (new-owner principal))
  (begin
    (asserts! (is-eq tx-sender (var-get contract-owner)) ERR_NOT_AUTHORIZED)
    (var-set pending-owner (some new-owner))
    (ok new-owner)))

(define-public (accept-ownership)
  (let ((pending (unwrap! (var-get pending-owner) ERR_NOT_AUTHORIZED)))
    (asserts! (is-eq tx-sender pending) ERR_NOT_AUTHORIZED)
    (var-set contract-owner pending)
    (var-set pending-owner none)
    (ok true)))

"""
anchor_bridge.py -- Batches and anchors trajectories to Stacks blockchain.

Runs as a Prefect flow on vm. Polls for unanchored trajectories, computes
Merkle roots, submits to Stacks via epoch_sdk.

Schedule: Every 10 minutes (aligned with Stacks block time).
"""
import hashlib
import json
import os
from datetime import datetime, timezone
from typing import Optional

from prefect import flow, task, get_run_logger

# Config
BATCH_SIZE = int(os.getenv("GVC_BATCH_SIZE", "20"))
MAX_WAIT_MINUTES = int(os.getenv("GVC_MAX_WAIT", "30"))
SUPABASE_URL = os.environ["SUPABASE_URL"]
SUPABASE_KEY = os.environ["SUPABASE_SERVICE_KEY"]
STACKS_NODE = os.getenv("STACKS_NODE", "https://stacks-node-api.mainnet.stacks.co")

@task
def get_unanchored_trajectories() -> list[dict]:
    """Fetch all unanchored trajectory versions from Supabase."""
    from supabase import create_client
    sb = create_client(SUPABASE_URL, SUPABASE_KEY)
    result = sb.schema("gvc").table("trajectory_versions") \
        .select("id, content_hash, agent_id, reward_score, created_at") \
        .eq("anchored", False) \
        .order("created_at") \
        .execute()
    return result.data

@task
def compute_merkle_root(hashes: list[bytes]) -> tuple[bytes, list]:
    """Build Merkle tree, return (root, proofs)."""
    if not hashes:
        return b'\x00' * 32, []

    leaves = list(hashes)
    # Pad to power of 2
    target = 1
    while target < len(leaves):
        target *= 2
    while len(leaves) < target:
        leaves.append(b'\x00' * 32)

    tree = [leaves]
    while len(tree[-1]) > 1:
        level = tree[-1]
        next_level = []
        for i in range(0, len(level), 2):
            combined = hashlib.sha256(level[i] + level[i + 1]).digest()
            next_level.append(combined)
        tree.append(next_level)

    root = tree[-1][0]

    # Compute individual proofs
    proofs = []
    for leaf_idx in range(len(hashes)):  # only real leaves, not padding
        proof = []
        idx = leaf_idx
        for level in tree[:-1]:
            sibling_idx = idx ^ 1
            side = idx % 2 == 1
            proof.append({"sibling": level[sibling_idx].hex(), "side": side})
            idx //= 2
        proofs.append(proof)

    return root, proofs

@task
def submit_anchor_to_stacks(
    merkle_root: bytes,
    trajectory_count: int,
    data_plane_hash: bytes,
    agent_count: int,
    reward_sum_x1000: int,
) -> Optional[str]:
    """Submit anchor transaction to Stacks blockchain."""
    logger = get_run_logger()
    try:
        from epoch_sdk import EpochClient
        client = EpochClient()
        result = client.call_contract(
            contract="trajectory-anchor",
            function="submit-anchor",
            args={
                "merkle-root": merkle_root.hex(),
                "trajectory-count": trajectory_count,
                "data-plane-hash": data_plane_hash.hex(),
                "agent-count": agent_count,
                "reward-sum-x1000": reward_sum_x1000,
            }
        )
        logger.info(f"Anchor submitted: tx={result.get('txid', 'unknown')}")
        return result.get("txid")
    except Exception as e:
        logger.error(f"Anchor submission failed: {e}")
        return None

@task
def mark_trajectories_anchored(
    trajectory_ids: list[str],
    batch_id: int,
    proofs: list[dict],
):
    """Update trajectories as anchored with Merkle proofs."""
    from supabase import create_client
    sb = create_client(SUPABASE_URL, SUPABASE_KEY)

    for tid, proof in zip(trajectory_ids, proofs):
        sb.schema("gvc").table("trajectory_versions") \
            .update({
                "anchored": True,
                "anchor_batch_id": batch_id,
                "merkle_proof": json.dumps(proof),
            }) \
            .eq("id", tid) \
            .execute()

@flow(name="gvc-anchor-bridge", log_prints=True)
def anchor_bridge_flow():
    """Main anchor bridge flow. Runs every 10 minutes."""
    logger = get_run_logger()

    # 1. Get unanchored trajectories
    unanchored = get_unanchored_trajectories()
    if not unanchored:
        logger.info("No unanchored trajectories. Skipping.")
        return

    logger.info(f"Found {len(unanchored)} unanchored trajectories")

    # 2. Check if batch is ready
    oldest_created = min(t["created_at"] for t in unanchored)
    oldest_age_minutes = (datetime.now(timezone.utc) -
                         datetime.fromisoformat(oldest_created)).total_seconds() / 60

    if len(unanchored) < BATCH_SIZE and oldest_age_minutes < MAX_WAIT_MINUTES:
        logger.info(
            f"Batch not ready: {len(unanchored)}/{BATCH_SIZE} trajectories, "
            f"oldest {oldest_age_minutes:.0f}/{MAX_WAIT_MINUTES} min"
        )
        return

    # 3. Take batch (up to BATCH_SIZE)
    batch = unanchored[:BATCH_SIZE]
    hashes = [bytes.fromhex(t["content_hash"]) for t in batch]

    # 4. Compute Merkle root
    root, proofs = compute_merkle_root(hashes)
    data_plane_hash = hashlib.sha256(b''.join(hashes)).digest()
    agent_ids = set(t["agent_id"] for t in batch)
    reward_sum = sum(t["reward_score"] for t in batch)

    logger.info(
        f"Merkle root: {root.hex()[:16]}..., "
        f"{len(batch)} trajectories, {len(agent_ids)} agents, "
        f"reward_sum={reward_sum:.3f}"
    )

    # 5. Record batch in Supabase
    from supabase import create_client
    sb = create_client(SUPABASE_URL, SUPABASE_KEY)
    batch_result = sb.schema("gvc").table("anchor_batches").insert({
        "merkle_root": root.hex(),
        "trajectory_count": len(batch),
        "data_plane_hash": data_plane_hash.hex(),
        "agent_count": len(agent_ids),
        "reward_sum": reward_sum,
        "status": "pending",
    }).execute()
    batch_id = batch_result.data[0]["id"]

    # 6. Submit to Stacks
    tx_id = submit_anchor_to_stacks(
        merkle_root=root,
        trajectory_count=len(batch),
        data_plane_hash=data_plane_hash,
        agent_count=len(agent_ids),
        reward_sum_x1000=int(reward_sum * 1000),
    )

    if tx_id:
        # Update batch status
        sb.schema("gvc").table("anchor_batches").update({
            "stacks_tx_id": tx_id,
            "status": "submitted",
        }).eq("id", batch_id).execute()

        # Mark trajectories as anchored
        trajectory_ids = [t["id"] for t in batch]
        mark_trajectories_anchored(trajectory_ids, batch_id, proofs)

        logger.info(f"Batch {batch_id} anchored: tx={tx_id}")
    else:
        sb.schema("gvc").table("anchor_batches").update({
            "status": "failed",
        }).eq("id", batch_id).execute()
        logger.error(f"Batch {batch_id} anchor FAILED")

if __name__ == "__main__":
    anchor_bridge_flow()

#!/usr/bin/env python3
"""
gvc -- Graph Version Control CLI

Usage:
    gvc status                     Show unanchored trajectories, current main path
    gvc log [--skill S] [--min-reward R] [--limit N]
                                   Show trajectory DAG
    gvc slice --anchor ID          Show visible trajectories from anchor
    gvc slice --agent DEVICE       Show agent's view
    gvc diff ID1 ID2               Compare two trajectories
    gvc merge --a ID --b ID --strategy S
                                   Merge divergent branches
    gvc anchor --batch             Anchor current unanchored batch
    gvc verify ID                  Verify trajectory's Merkle proof
    gvc policy list                List registered policies
    gvc policy set AGENT POLICY    Set agent's topology policy
    gvc viz [--agent DEVICE]       Open Spatial-Git visualization
    gvc main-path                  Show highest-reward path
"""
import argparse
import json
import sys
import os
import webbrowser

GRAPH_KERNEL_URL = os.getenv("GRAPH_KERNEL_URL", "http://localhost:8001")
SUPABASE_URL = os.environ.get("SUPABASE_URL", "")
SUPABASE_KEY = os.environ.get("SUPABASE_SERVICE_KEY", "")

def cmd_status(args):
    """Show current system status."""
    import httpx
    # Get unanchored count
    from supabase import create_client
    sb = create_client(SUPABASE_URL, SUPABASE_KEY)
    unanchored = sb.schema("gvc").table("trajectory_versions") \
        .select("id", count="exact") \
        .eq("anchored", False).execute()
    total = sb.schema("gvc").table("trajectory_versions") \
        .select("id", count="exact").execute()
    anchored = sb.schema("gvc").table("anchor_batches") \
        .select("id", count="exact") \
        .eq("status", "confirmed").execute()

    print(f"Trajectory Versions:  {total.count}")
    print(f"  Anchored:           {total.count - unanchored.count}")
    print(f"  Unanchored:         {unanchored.count}")
    print(f"Anchor Batches:       {anchored.count} confirmed")
    print()

    # Get main path
    try:
        r = httpx.get(f"{GRAPH_KERNEL_URL}/api/trajectory/main-path", timeout=5)
        if r.status_code == 200:
            data = r.json()
            path = data.get("path", [])
            reward = data.get("cumulative_reward", 0)
            print(f"Main Path: {len(path)} trajectories, cumulative reward {reward:.3f}")
            for t in path[-5:]:
                print(f"  {t['id'][:8]}... [{t['skill_label']}] reward={t['reward_score']:.3f}")
    except Exception:
        print("Main Path: Graph Kernel unreachable")

def cmd_log(args):
    """Show trajectory DAG."""
    from supabase import create_client
    sb = create_client(SUPABASE_URL, SUPABASE_KEY)
    query = sb.schema("gvc").table("trajectory_versions") \
        .select("id, parent_ids, skill_label, reward_score, agent_device, created_at, anchored") \
        .order("created_at", desc=True) \
        .limit(args.limit or 20)
    if args.skill:
        query = query.eq("skill_label", args.skill)
    if args.min_reward:
        query = query.gte("reward_score", args.min_reward)
    result = query.execute()

    for t in result.data:
        anchor_mark = "A" if t["anchored"] else "."
        parents = ",".join(p[:8] for p in (t["parent_ids"] or []))
        print(
            f"[{anchor_mark}] {t['id'][:12]}  "
            f"r={t['reward_score']:.3f}  "
            f"{t['skill_label']:20s}  "
            f"{t['agent_device']:6s}  "
            f"parents=[{parents}]  "
            f"{t['created_at'][:19]}"
        )

def cmd_slice(args):
    """Show visible trajectories from anchor."""
    import httpx
    payload = {}
    if args.anchor:
        payload["anchor_trajectory_id"] = args.anchor
    elif args.agent:
        payload["agent_device"] = args.agent
    r = httpx.post(f"{GRAPH_KERNEL_URL}/api/trajectory/slice",
                   json=payload, timeout=10)
    data = r.json()
    print(f"Visible trajectories: {len(data.get('trajectory_ids', []))}")
    print(f"Admissibility [sensitive field redacted], 'N/A')[:16]}...")
    for tid in data.get("trajectory_ids", [])[:20]:
        print(f"  {tid}")

def cmd_viz(args):
    """Open Spatial-Git visualization."""
    url = f"file://{os.path.expanduser('Desktop/spatial-git/index.html')}"
    if args.agent:
        url += f"?agent={args.agent}"
    webbrowser.open(url)
    print(f"Opened: {url}")

def main():
    parser = argparse.ArgumentParser(prog="gvc", description="Graph Version Control")
    sub = parser.add_subparsers(dest="command")

    sub.add_parser("status")

    p_log = sub.add_parser("log")
    p_log.add_argument("--skill", type=str)
    p_log.add_argument("--min-reward", type=float)
    p_log.add_argument("--limit", type=int, default=20)

    p_slice = sub.add_parser("slice")
    p_slice.add_argument("--anchor", type=str)
    p_slice.add_argument("--agent", type=str)

    p_viz = sub.add_parser("viz")
    p_viz.add_argument("--agent", type=str)

    args = parser.parse_args()
    commands = {
        "status": cmd_status,
        "log": cmd_log,
        "slice": cmd_slice,
        "viz": cmd_viz,
    }
    if args.command in commands:
        commands[args.command](args)
    else:
        parser.print_help()

if __name__ == "__main__":
    main()