#!/usr/bin/env python3
"""Root-only one-time intake; no live requests or business writes."""
import csv
import hashlib
import io
import json
import subprocess
import sys
from pathlib import Path
import integrate_20261010 as tool

REPORT = 'work/2026-09-28-smart-canteen-dm8-poc/matrix-integration/ROOT_ACCEPTANCE_20261014_1141_1201.md'
P = tool.ROOT.parent / 'worktrees/dm8-compat-20261012/private-prepay-harness'

def verify():
    checks = [
        ('review-evaluate1161-1201/verify.py', 'f39490f5cdbb5b510118ba9a689ad02c4711b90a7b8a9e504c296be74268c779', 'independent_checks', 73),
        ('review-s2-refresh1141-final/verify_independent.py', '826dd7f066303588d36e3a3b1ae8f48642c6db1726e02f2ea308df8a36c6e550', 'checks', 25219),
    ]
    for name, sha, key, count in checks:
        path = P / name
        assert hashlib.sha256(path.read_bytes()).hexdigest() == sha
        r = json.loads(subprocess.check_output([sys.executable, '-B', str(path)]))
        assert r[key] == count and r['new_SQL'] == r['new_HTTP'] == 0
    subprocess.check_call(['git', '-C', str(tool.source_root('ai_api')), 'merge-base', '--is-ancestor',
        'a549f659f41c824e9fd6fd6a58712730368b3954', 'develop_dameng'])

def main():
    audit = Path(__file__).with_name('integration-20261014-evaluate-refresh.json')
    assert not audit.exists(), 'Do not replay main'
    verify()
    assert (tool.ROOT / REPORT).is_file()
    pending, previous = [], []
    for file, key in [(tool.COVERAGE, 'route_or_command'), (tool.CONTRACT, 'path')]:
        headers, rows, raw = tool.read_csv(file)
        touched = []
        for action in ('list', 'detail'):
            path = '/api/orderevaluate/' + action
            selected = [r for r in rows if r['method'] == 'POST' and r[key].lower() == path]
            assert len(selected) == 1
            r = selected[0]
            assert r['repo'] == ('unreviewed' if action == 'list' else 'store')
            touched.append(dict(r))
            scope = 'own-day-nonempty-and-page2-empty' if action == 'list' else 'own-parent-hidden-dish-detail-nonempty-relation'
            r.update(repo='store', evidence=tool.append_evidence(r['evidence'], REPORT))
            if key == 'route_or_command':
                r.update(db_access_review='source-pinned-original-HTTP-ORM-PDO-owned-read',
                    mysql_http_or_command='tested-pass',
                    dm_http_or_command='tested-pass',
                    database_readback='tested-pass-full-owned-rows-native-value-and-type-readback',
                    external_stub='no-external-call-private-test-token-and-bounded-SQL-observer')
            else:
                r.update(delivery_scope='sampled-owned-business-read-only-not-full-acceptance',
                    reachability='tested-original-POST-controller-service-dispatch',
                    db_scope='local-MySQL-store-and-approved-nonproduction-DM-ZHCT_APP',
                    success_case='partial-evidence-' + scope,
                    mysql_input_and_readback='tested-pass-complete-owned-native-rows',
                    dm_input_and_readback='tested-pass-complete-owned-native-rows',
                    response_parity='partial-evidence-full-JSON-values-and-types-verified-against-native-source',
                    boundary_empty_min_max=('partial-evidence-page2-empty-original-current-page1' if action == 'list' else 'not-tested-empty-relation-count2-only'),
                    fixture='owned-future-date-parent-hidden-dish-detail-user0-no-natural-content',
                    cleanup='marked-test-data-retained-private-servers-stopped', coverage_gate='open')
        if key == 'route_or_command':
            selected = [r for r in rows if r['kind'] == 'command' and r['repo'] == 'ai_api' and r[key] == 'ai_api:RefreshToken.php']
            assert len(selected) == 1
            r = selected[0]; touched.append(dict(r))
            r.update(mysql_http_or_command='partial-evidence-original-think-normal-and-controlled-clock-noop',
                dm_http_or_command='partial-evidence-original-think-normal-and-controlled-clock-noop',
                database_readback='tested-pass-full-owned-token-and-store-columns-values-types-normal-and-noop',
                external_stub='lowest-OAuth-transport-fake-private-Store-binding-noop-command-clock-only',
                evidence=tool.append_evidence(r['evidence'], REPORT))
        out = io.StringIO(newline='')
        writer = csv.DictWriter(out, fieldnames=headers, lineterminator='\r\n' if b'\r\n' in raw else '\n')
        writer.writeheader(); writer.writerows(rows)
        pending.append((file, raw, out.getvalue().encode()))
        previous.append({'file': str(file.relative_to(tool.ROOT)), 'old_rows': touched})
    assert all(p.read_bytes() == raw for p, raw, _ in pending), 'Concurrent matrix change'
    for p, _, new in pending: p.write_bytes(new)
    audit.write_text(json.dumps({'old': previous, 'new_HTTP_keys': 0, 'enhanced_HTTP_keys': 2,
        'enhanced_command_keys': 1, 'evidence': REPORT, 'all_gates_remain_open': True}, ensure_ascii=False, indent=2) + '\n')
    print('Accepted two bounded HTTP keys and one bounded command; no new keys')

if __name__ == '__main__':
    main()