#!/usr/bin/env python3
"""Archive SecurityAudit's actual source evidence and explicit replay limitation."""
import hashlib
import json
from pathlib import Path
import subprocess
import integrate_20261010 as tool

BASE=tool.STORE+'parallel-store-security-audit-readonly-20261010/'

def verify():
    c=tool.load(BASE+'comparison.json')
    assert c['passed'] and c['actual_http']==16
    assert len(c['checks'])==20 and all(c['checks'].values())
    assert len(c['mutation_checks'])==16 and all(c['mutation_checks'].values())
    m=tool.load(BASE+'manifest.json')
    assert m['unique_operations']==1 and m['actual_HTTP']['total']==16
    assert m['all_CLI_assertions']==52 and m['all_failed_CLI_assertions']==8
    assert m['final_green']['HTTP']==6 and m['final_green']['assertions']==30
    assert m['business_DML']==m['DDL']==0
    for path,sha in m['files_sha256'].items():
        assert hashlib.sha256((tool.ROOT/BASE/path).read_bytes()).hexdigest()==sha
    for path,sha in tool.load(BASE+'source-hashes.json').items():
        assert hashlib.sha256((tool.ROOT.parent/'zhctproject/store/application'/path).read_bytes()).hexdigest()==sha
    for lane in ['B','C']:
        r=tool.load(BASE+'final-audit-'+lane+'.json')
        assert r['scope_count']==3 and r['scope_unchanged'] and r['actor_unchanged']
        assert r['business_dml']==r['ddl']==0 and r['actual_http']==8
    r=tool.load(BASE+'resource-cleanup.json')
    assert r['ports_18321_18322_closed'] and r['raw_response_token_source_config_cache_original_cli_reports_removed']
    assert r['owned_worker_B']['stopped'] and r['owned_worker_C']['stopped'] and r['db_cleanup_writes']==0
    # Actual natural raw was reclaimed by the child. Never pretend this synthetic
    # comparator test replays those historical customer rows.
    r=subprocess.run(['node',str(tool.ROOT/BASE/'test_compare_synthetic.js')],check=True,capture_output=True,text=True)
    r=json.loads(r.stdout)
    assert r['status']=='PASS' and r['synthetic_only'] and not r['historical_natural_value_replay_claimed']

if __name__=='__main__':
    audit=Path(__file__).with_name('integration-20261010-batch38.json')
    assert not audit.exists(),'Preserve original transition audit'
    item=dict(repo='store',method='POST',path='/p/securityAudit/lists',module='安全审计历史列表读取',terminal='current-PC',
        role='normal-active-type0-private-auth',risk='readonly',scope='store-primary-fixed-three-historical-rows-and-actor-readonly',
        evidence=BASE+'REPORT.md',request_type='current-PC-form',
        parity='partial-evidence-complete-18-field-per-lane-source-new-Query-filter-keyword-contract-plus-DM-seconds-format',
        cleanup='zero-DML-historical-source-and-actor-stable-workers-token-cache-released-master-transferred-natural-raw-reclaimed',
        boundary_empty_min_max='partial-evidence-page1-two-page2-one-keyword-miss-zero-C-nonempty-context-and-wide-ids-unverified')
    tool.main([item],audit,verify)