#!/usr/bin/env python3
"""Enhance existing identity keys after reviewed local merge, not full closure."""
import hashlib
import json
import subprocess
import sys
from pathlib import Path
import integrate_20261010 as tool
from integrate_20261011_batches46_48 import item

def verify():
    p = tool.ROOT.parent / 'worktrees/dm8-compat-20261012/private-prepay-harness/review-identity1481/verify_independent.py'
    assert hashlib.sha256(p.read_bytes()).hexdigest() == 'acf588e295e48a37be52da046388bf5b6629495d74f5b97d839cac4d93a799dd'
    r = json.loads(subprocess.check_output([sys.executable, '-B', str(p)]))
    assert r['passed'] and r['checks'] == 21786 and r['sealed_assets'] == 171
    assert r['new_SQL_HTTP_business_CLI'] == 0 and r['old1441_red_preserved']
    subprocess.check_call(['git', '-C', str(tool.source_root('store')), 'merge-base', '--is-ancestor', r['commit'], 'develop_dameng'])

if __name__ == '__main__':
    audit = Path(__file__).with_name('integration-20261014-identity1481.json')
    assert not audit.exists(), 'Never replay main'
    report = 'work/2026-09-28-smart-canteen-dm8-poc/matrix-integration/ROOT_IDENTITY1481_MERGE_20261014.md'
    rows = [item('store', 'POST', '/api/identity/' + action, '', evidence=report,
        scope='new-owned-unreferenced-identity-original-CRUD-audit-DM-update-time-DTO-only-fix',
        risk='owned-enumeration-original-audit-separate-commits-no-role-or-user',
        success_case='partial-evidence-new-object-original-CRUD-time-contract-fixed',
        readback='tested-pass-identity9-audit20-full-native-commit-readback-stored-time-unchanged',
        parity='partial-evidence-full-six-field-types-create-string-id-update-int-id-seconds-delete-array',
        cleanup='new-identity-original-softdeleted-audits-retained-old1441-successful-writes-not-replayed')
        for action in ('create', 'update', 'delete')]
    tool.main(rows, audit, verify)