#!/usr/bin/env python3
"""Install only the approved new namespace and one isolated HTTP route branch."""
import hashlib
import json
import shlex
import subprocess
import sys
from pathlib import Path

root=Path(__file__).parent
lane=sys.argv[1]
assert lane in ('B','C')
runtime='/tmp/cdx-store-category9-B.cVux2z' if lane=='B' else '/tmp/cdx-store-category9-C.Hr1w83'
candidate=(root/'index.schema-candidate.php').read_bytes()
branch=b"if(($_SERVER['HTTP_X_CDX_SCOPE']??'')==='schema-api-evidence'){require __DIR__.'/schema-api-index.php';exit;}\n"
original_expected=candidate.replace(branch,b'',1)
def command(code):
    args=['docker','exec','-i','zhctapp_v2_0','/usr/local/php7.3/bin/php','-r',code] if lane=='B' else ['ssh','-S','/private/tmp/cdx-train-root-20261010.sock','-o','BatchMode=yes','root@121.43.241.161','/www/server/php/73/bin/php -r '+shlex.quote(code)]
    return args
original=subprocess.check_output(command('echo file_get_contents('+repr(runtime+'/index.php')+');'))
assert original==original_expected,'Original dispatcher drift: do not overwrite'
evidence=root/'api-private-evidence'/lane
evidence.mkdir(parents=True,mode=0o700,exist_ok=True)
(root/'api-private-evidence').chmod(0o700)
(evidence/'index-before.php').write_bytes(original);(evidence/'index-before.php').chmod(0o600)
if lane=='B':
    snapshot=json.loads((root/'private-evidence/B-fresh-v2.json').read_text())
    sealed=root.parents[2]/'work_store/apifox/2026-09-30-dm8-interface-acceptance/parallel-store-category-crud-20261011/private-evidence/B/final.json'
    full=json.loads(sealed.read_text())['source']
    assert full['material_category']==snapshot['rows']
else:
    full=json.loads((root/'schema-private-evidence/C-schema-post-read-v2.json').read_text())['source']
keys=['staff_sha256','user_sha256','actor_sha256','nutrition_category','material_category']
baseline={key:full[key] for key in keys}
files={name:(root/name).read_bytes() for name in ['schema-api-common.php','schema-api-index.php','schema-api-run.php']}
files['index.php']=candidate
files['schema-api-evidence/expected-baseline.json']=json.dumps(baseline,ensure_ascii=False,separators=(',',':')).encode()
import base64
payload=json.dumps({name:base64.b64encode(content).decode() for name,content in files.items()}).encode()
code='$root='+repr(runtime)+';$files=json_decode(file_get_contents("php://stdin"),true);if(is_dir($root."/schema-api-evidence"))throw new RuntimeException("No namespace replay");if(hash_file("sha256",$root."/index.php")!=='+repr(hashlib.sha256(original).hexdigest())+')throw new RuntimeException("Dispatcher drift");mkdir($root."/schema-api-evidence",0700);foreach($files as $name=>$data){file_put_contents($root."/".$name,base64_decode($data));chmod($root."/".$name,0600);}echo "installed approved namespace only\n";'
result=subprocess.run(command(code),input=payload,check=True,capture_output=True)
print(lane,result.stdout.decode().strip())
print('dispatcher_before_sha256',hashlib.sha256(original).hexdigest(),'dispatcher_after_sha256',hashlib.sha256(candidate).hexdigest())