import importlib.util,json,os,pathlib,shutil
from build import R,g,HEAD,OLD
os.umask(0o077)
def main():
 assert not (R/'plan.json').exists()
 assert g.sh(['git','-C',str(g.REPO),'rev-parse','HEAD']).strip()==HEAD
 assert not g.sh(['git','-C',str(g.REPO),'status','--porcelain']).strip()
 b=json.loads((OLD/'build.json').read_text())
 assert json.loads(g.sh(['docker','image','inspect',b['image_id']]))[0]['Id']==b['image_id']
 assert all(g.sha(p)==g.sha(OLD/'snapshot'/p.relative_to(g.REPO)) for p in (g.REPO/'app').rglob('*.py'))
 assert g.sha(g.REPO/'docker/entrypoint.sh')==g.sha(OLD/'snapshot/docker/entrypoint.sh')
 (R/'build.json').write_text(json.dumps(b));(R/'source.json').write_bytes((OLD/'source.json').read_bytes())
 prior=pathlib.Path('/tmp/codex/ltb1021/2026-09-11_contextra-metadata-auth_r01')
 shutil.copyfile(prior/'firewall.py',R/'firewall.py')
 s=importlib.util.spec_from_file_location('prior_prepare',prior/'prepare.py')
 m=importlib.util.module_from_spec(s);s.loader.exec_module(m)
 m.C=g.ENV.parent/'metadata-active';m.main()
 p=json.loads((R/'plan.json').read_text());C=pathlib.Path(p['controls'])
 override=g.yaml.safe_load((C/'compose.yaml').read_text())
 app=override['services']['analytics'];app['image']=b['image_id']
 app['restart']='on-failure:3'
 app['environment']['CONTEXTRA_METADATA_VISUAL_DIR']=''
 app['volumes']=[]
 (C/'compose.yaml').write_text(g.yaml.safe_dump(override))
 diag=R/'diagnostics';diag.mkdir(mode=0o700)
 diagnostic={'services':{'analytics':{'restart':'no','environment':{
  'CONTEXTRA_START_DIAGNOSTICS_DIR':'/run/contextra-boundary','CONTEXTRA_METADATA_VISUAL_DIR':'/run/contextra-visual'},
  'volumes':[{'type':'bind','source':str(diag),'target':'/run/contextra-boundary','bind':{'create_host_path':False}},
             {'type':'bind','source':str(R/'visual'),'target':'/run/contextra-visual','bind':{'create_host_path':False}}]}}}
 (R/'diagnostic-compose.yaml').write_text(g.yaml.safe_dump(diagnostic))
 p['persistent_compose']=list(p['compose'])
 p['compose']+=['-f',str(R/'diagnostic-compose.yaml')]
 p['control_hashes']={str(x):g.sha(x) for x in C.iterdir() if x.is_file()}
 p['control_hashes'][str(R/'diagnostic-compose.yaml')]=g.sha(R/'diagnostic-compose.yaml')
 rendered=json.loads(g.sh(p['compose']+['config','--format','json']))
 assert rendered['services']['analytics']['image']==b['image_id']
 assert rendered['services']['analytics']['restart']=='no'
 assert len(rendered['services']['redis']['ports'])==1
 p['temporary_controls']={'diagnostics':'RETAIN current container to avoid recreate; default persistent compose excludes diagnostic overlay',
  'capture':'REMOVE flag after window; visual mount RETAIN only in current container',
  'display':'.1 window only; restore configured score through settings CAS',
  'restart':'RESET actual and diagnostic override to original on-failure:3 after stopped'}
 (R/'plan.json').write_text(json.dumps(p,indent=2))
 print(json.dumps(dict(actual_gate='PASS',image_reused=True,source_equal=True,redis_empty=True,readers=2,persistent_and_diagnostic_split=True)))
if __name__=='__main__':main()