#!/usr/bin/env python3
"""Only limited source enum and prerequisite read evidence, not business SQL pass."""
import hashlib
import json
import subprocess
import sys
from pathlib import Path
import integrate_20261010 as tool
from integrate_20261011_batches46_48 import item

def verify():
    p = tool.ROOT.parent / 'worktrees/dm8-compat-20261012/private-prepay-harness/review-passport1501/verify_independent.py'
    assert hashlib.sha256(p.read_bytes()).hexdigest() == '6f32364807d00658cbb126b05ae95219823ed61b40a7ba54df092de9b5cce3e1'
    r = json.loads(subprocess.check_output([sys.executable, '-B', str(p)]))
    assert r['passed'] and r['checks'] == 17787 and r['sealed_assets'] == 6278
    assert r['new_SQL_HTTP_business_CLI'] == r['writes'] == r['health_HTTP'] == 0
    assert not r['WeChat_or_permission_acceptance'] and r['source_derived_auth_fields'] == 24

if __name__ == '__main__':
    audit = Path(__file__).with_name('integration-20261014-passport1501.json')
    assert not audit.exists(), 'Never replay main'
    report = 'work/2026-09-28-smart-canteen-dm8-poc/matrix-integration/ROOT_PASSPORT1501_LIMITED_20261014.md'
    rows = [item('ai_api', 'POST', '/api/passport/' + action, '', evidence=report,
        scope='source-enum-business-body-no-SQL-only-original-own-Store-logo-prerequisite-read',
        mysql_state='partial-evidence-source-enum-and-prerequisite-DB-only',
        dm_state='partial-evidence-source-enum-and-prerequisite-DB-only',
        success_case='partial-evidence-limited-enum-standard-enterprise-and-known-appid-only',
        readback='tested-pass-owned-original-Store18-exact-types-unchanged-empty-scoped-logo',
        parity='partial-evidence-full-source-derived-DTO-native-types-enum-only-not-authorization',
        cleanup='zero-new-rows-private-workers-stopped-old-Store-unchanged')
        for action in ('mpWxEnterpriseOptions', 'enterpriseAuth')]
    tool.main(rows, audit, verify)