1. Build a ChatRequest with messages + tool specs
2. provider.chat(req) → ChatResponse
3. If response has tool_calls:
       for each call: result = ToolsRuntime.run_tool(name, args)
       append a tool message; goto 2
4. Otherwise: stop. The response.content is the answer.

"""
Part 5: One-shot agent that executes a single TestCaseRun on the
IoT-camera operation. Uses Wintermute's tool_calling_chat against
Bedrock Claude with the i2c + firmware_analysis cartridges loaded.
Pre-conditions:
  - operation `acme-iotcam-2026-Q2` already saved (Part 2).
  - JsonFileBackend registered.
  - AWS_REGION + Bedrock model configured.
"""
from __future__ import annotations
import logging
from datetime import datetime, timezone
from wintermute.ai.bootstrap import init_router
from wintermute.ai.tools_runtime import tools as registry, spec_from_tool
from wintermute.ai.types import ChatRequest, Message, ToolSpec
from wintermute.ai.use import tool_calling_chat
from wintermute.backends.json_storage import JsonFileBackend
from wintermute.cartridges.manager import CartridgeManager
from wintermute.core import Operation, RunStatus
from wintermute.findings import ReproductionStep, Vulnerability
log = logging.getLogger("wintermute.agent.part5")
logging.basicConfig(level=logging.INFO)
# ---------------------------------------------------------------------------
# 0. Engagement load
# ---------------------------------------------------------------------------
Operation.register_backend(
    "json", JsonFileBackend(base_path="./.wintermute_data"), make_default=True
)
op = Operation("acme-iotcam-2026-Q2")
op.load()
# Find the run we want to drive.
target_run_id = "IOT-HW-I2C-001:iot-cam-01:mcio-eeprom-1"
run = next(r for r in op.test_runs if r.run_id == target_run_id)
tc  = next(t for t in op.iterTestCases() if t.code == run.test_case_code)
peripheral = next(p for p in op.getDeviceByHostname("iot-cam-01").peripherals
                  if p.name == "mcio-eeprom-1")
# ---------------------------------------------------------------------------
# 1. AI bootstrap + cartridge load (capability surface)
# ---------------------------------------------------------------------------
router = init_router()                                # Bedrock default
mgr = CartridgeManager()
for name in ("i2c", "firmware_analysis"):
    if name not in mgr.list_loaded():
        mgr.load(name)
# A curated tool list — we DO NOT hand the agent the full global registry.
# The 80+ MCP tools would balloon the prompt and tempt the model into
# unrelated work.
allowed_tools = ("detect", "dump_eeprom",
                 "extract_strings", "scan_for_secrets")
tool_specs: list[ToolSpec] = [
    spec_from_tool(t)
    for name, t in registry._tools.items()
    if name in allowed_tools
]
log.info("Tools available to agent: %s", [t.name for t in tool_specs])
# ---------------------------------------------------------------------------
# 2. System prompt — engagement-grounded
# ---------------------------------------------------------------------------
system = f"""You are an autonomous hardware security analyst working a
sanctioned penetration test for ACME on engagement
{op.operation_name!r}.
Scope (the only thing you may touch in this turn):
  - Device : {peripheral.__dict__.get('name', 'unknown')!r} on host iot-cam-01
  - Bus    : I2C-2
  - Address: 0x{0x50:02x}
  - Test case: {tc.code} — {tc.name}
Available tools:
  detect()                              -> list of int (responding I2C addresses on bus 2)
  dump_eeprom(address: int, size: int)  -> blob descriptor (file_path/sha256/size)
  extract_strings(file_path: str, min_length: int) -> top printable strings + counts
  scan_for_secrets(file_path: str)      -> regex+byte-pattern hits (PEM, AWS keys, ...)
Process:
1. detect() to confirm the EEPROM is at 0x50.
2. dump_eeprom(0x50, 256). Pass the returned `file_path` to subsequent
   tools — never embed bytes in your reply.
3. Run extract_strings (min_length=8) and scan_for_secrets on the dump.
4. Decide whether the dump contains a security-relevant artifact:
   credentials, private keys, hardcoded URLs, command tokens.
5. Reply with a JSON object of the form:
     {{
       "verdict": "passed" | "failed",
       "title": "<concise vuln title or empty>",
       "description": "<2-3 sentences>",
       "cvss": <int 0-10>,
       "evidence_offsets": ["0x<hex>", ...],
       "interesting_strings": ["<str>", ...]
     }}
   `passed` means no finding; `failed` means a vulnerability is recorded.
Constraints:
- Do not call any tool outside the four above.
- Do not invent reproduction steps; the framework records them from your
  tool calls.
- Stop after one diagnostic round-trip.
"""
# ---------------------------------------------------------------------------
# 3. Run — start the test run, dispatch the loop, parse the verdict
# ---------------------------------------------------------------------------
run.status = RunStatus.in_progress
run.start()
run.executed_by = "wintermute-agent-part5"
messages = [
    Message(role="system", content=system),
    Message(role="user",
            content=f"Execute test case {tc.code} now. Reply with the JSON verdict only."),
]
# Loop: tool_calling_chat handles one round; we drive the round-trip until
# the model returns content with no tool_calls.
import json
while True:
    resp = tool_calling_chat(router, messages, tool_specs, response_format="text")
    if not resp.tool_calls:
        verdict = json.loads(resp.content)
        break
    # Execute every tool the model requested, append tool messages, loop.
    messages.append(
        Message(role="assistant",
                content=resp.content or "",
                tool_call_id=None, tool_name=None)
    )
    for call in resp.tool_calls:
        result = registry.call(call.name, dict(call.arguments))
        messages.append(
            Message(role="tool",
                    content=json.dumps(result, default=str),
                    tool_name=call.name,
                    tool_call_id=call.id)
        )
# ---------------------------------------------------------------------------
# 4. Write the verdict back into the live operation
# ---------------------------------------------------------------------------
if verdict["verdict"] == "failed":
    vuln = Vulnerability(
        title=verdict["title"],
        description=verdict["description"],
        cvss=int(verdict["cvss"]),
        threat="unauthorized device access via static artifact",
        verified=True,
        reproduction_steps=[
            ReproductionStep(
                title="Probe I2C bus 2",
                tool="i2c.detect", action="probe",
                confidence=85, arguments=[]),
            ReproductionStep(
                title="Read 256 bytes from 0x50",
                tool="i2c.dump_eeprom", action="read",
                confidence=90, arguments=["0x50", "256"]),
            ReproductionStep(
                title="Static analysis: strings + secret scan",
                tool="firmware_analysis", action="analyze",
                confidence=80,
                arguments=verdict.get("evidence_offsets", [])),
        ],
    )
    run.findings.append(vuln)
    run.status = RunStatus.failed
else:
    run.status = RunStatus.passed
run.notes = (
    f"agent={run.executed_by} ts={datetime.now(timezone.utc).isoformat()} "
    f"strings_seen={len(verdict.get('interesting_strings', []))} "
    f"verdict={verdict['verdict']}"
)
run.finish()
op.save()
log.info("Test run %s -> %s", run.run_id, run.status.value)

tool_specs = [
    spec_from_tool(t) for name, t in registry._tools.items()
    if name in ("detect", "extract_strings", "scan_for_secrets",
                "ai_list_test_runs")    # console-bound read-only AI tool
]
system = "You are a recon analyst. Only read. ..."
# ... same loop, no `run.findings.append(...)`.