#!/usr/bin/env python3
"""One-time intake of four scoped command reads, never HTTP coverage."""
import csv
import hashlib
import io
import json
import subprocess
import sys
from pathlib import Path
import integrate_20261010 as tool

HERE = Path(__file__).resolve().parent
REPORT = 'work_ai_api/apifox/2026-09-30-dm8-interface-acceptance/parallel-healthkit-cli-20261013/ROOT_REVIEW.md'
BLOCK = tool.STORE + 'parallel-full-think-block-20261013/ROOT_REVIEW.md'
KEYS = {'ai_api:' + name + '.php' for name in ('DailyActivitySummary', 'DailyPolymerize', 'ActivityRecords', 'SampleSetPolymerize')}

def verify():
    p = Path('/private/tmp/cdx-ai-hk-course-b.Kmdirn/review-s2-781-healthkit/verify_review.py')
    assert hashlib.sha256(p.read_bytes()).hexdigest() == '84418632b93cbee4ced797bdf8281c703af01989d6fc9df1ea07ea558de1b790'
    r = json.loads(subprocess.check_output([sys.executable, '-B', str(p)]))
    assert r['offline'] and r['checks'] == 325 and r['assets'] == 105
    assert r['original_think_CLI_per_side'] == 4 and r['DB_HTTP_business_CLI_executed'] == 0
    assert not r['real_Huawei_verified'] and r['sql_counts'] == {'B': 35, 'C': 45}
    subprocess.check_call(['git', '-C', str(tool.source_root('ai_api')), 'merge-base', '--is-ancestor', r['source_commit'], 'develop_dameng'])
    p = tool.ROOT.parent / 'worktrees/dm8-compat-20261012/private-prepay-harness/review-s3-801-fullthink/verify_independent.py'
    assert hashlib.sha256(p.read_bytes()).hexdigest() == 'a6bc549076213009cf0b94b5a2fb16e75faef1b4ff0fe455e6a2264db85a2e16'
    r = json.loads(subprocess.check_output([sys.executable, '-B', str(p)]))
    assert r['passed'] and r['checks'] == 423 and r['target_command_executions'] == 0

if __name__ == '__main__':
    audit = HERE / 'integration-20261013-healthkit-cli.json'
    assert not audit.exists(), 'Never replay main'
    verify()
    assert all((tool.ROOT / p).is_file() for p in [REPORT, BLOCK])
    headers, rows, raw = tool.read_csv(tool.COVERAGE)
    previous = []
    for row in rows:
        if row['kind'] != 'command':
            continue
        if row['repo'] == 'ai_api' and row['route_or_command'] in KEYS:
            previous.append(dict(row))
            row.update(risk='synthetic-healthkit-token-scoped-read-no-real-external',
                db_access_review='original-command-model-query-one-SELECT-family',
                mysql_http_or_command='partial-evidence-original-think-private-prebound-Store-lowest-curl-stub',
                dm_http_or_command='partial-evidence-original-think-private-prebound-Store-lowest-curl-stub',
                database_readback='tested-pass-complete-owned-Store18-token15-unchanged-runtime-DML0',
                external_stub='lowest-curl-only-real-network-denied-original-header-and-time-gaps-retained',
                evidence=tool.append_evidence(row['evidence'], REPORT))
        elif row['repo'] == 'store' and row['route_or_command'] in {'store:OneCardSystemCardBackfill.php', 'store:OneCardLoginAccountBackfill.php'}:
            row['evidence'] = tool.append_evidence(row['evidence'], BLOCK)
    assert len(previous) == 4 and {r['route_or_command'] for r in previous} == KEYS
    out = io.StringIO(newline='')
    writer = csv.DictWriter(out, fieldnames=headers, lineterminator='\r\n' if b'\r\n' in raw else '\n')
    writer.writeheader(); writer.writerows(rows)
    new = out.getvalue().encode()
    assert tool.COVERAGE.read_bytes() == raw, 'Concurrent matrix writer'
    tool.COVERAGE.write_bytes(new)
    audit.write_text(json.dumps({'command_keys': sorted(KEYS), 'HTTP_increment': 0,
        'all_explicit_SQL_corrected': {'B': 37, 'C': 47}, 'old_rows': previous,
        'before_sha256': hashlib.sha256(raw).hexdigest(), 'after_sha256': hashlib.sha256(new).hexdigest(),
        'evidence': REPORT, 'full_think_block_evidence': BLOCK}, ensure_ascii=False, indent=2) + '\n')
    print(json.dumps({'updated_commands': 4, 'HTTP_increment': 0, 'full_system_complete': False}))